Topic starter
24/06/2026 11:22 pm
TL;DR: Identity and access management tools are being pushed beyond human sign-in into CI/CD pipelines, service accounts, tokens, and AI-powered agents, with Apono citing 78% of organisations planning to increase IAM spending because identity-based attacks drive phishing and lateral movement. The real challenge is no longer authentication alone but governing standing privilege across human and non-human identities before cloud sprawl turns access into exposure.
Editorial analysis by NHI Mgmt Group, based on content published by Apono: “Top 10 Identity and Access Management Tools”.
By the numbers:
- 78% of organizations plan to ramp up spending on identity and access management tools to ease concerns over identity-based attacks that lead to phishing and lateral movement.
Key questions
Q: How should security teams govern NHIs inside IAM programmes?
A: Security teams should treat NHIs as part of the main access estate, not as an afterthought to human IAM.
Q: Why do standing privileges become more dangerous in multi-cloud environments?
A: Because each cloud can accumulate excess rights independently, so a role that looks acceptable in one platform may still create lateral movement risk when combined with access in another.
Q: What breaks when access reviews do not include machine and AI identities?
A: Review cycles miss the identities that often move the most data and inherit the most privilege.
Practitioner guidance
- Map non-human identities into the IAM inventory Inventory CI/CD pipelines, service accounts, API tokens, certificates, and bots alongside human identities so access reviews cover the real estate being used in production.
- Replace standing privilege with time-bound access Use JIT and just-enough privilege for operational access, especially where cloud providers, internal tools, and production systems are touched by automation.
- Tie secrets governance to entitlement governance Treat API keys, tokens, and certificates as governed access assets, with rotation, ownership, and revocation aligned to the identities that use them.
Bottom line: IAM now has to govern non-human identities such as pipelines, service accounts, tokens, and bots as part of the core access estate.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 8:12 am
NHI governance is now an IAM core requirement, not a niche add-on. The article describes a world where access is no longer dominated by employee accounts but by pipelines, service accounts, tokens, and bots. That changes the centre of gravity for identity programmes, because unmanaged NHIs can create the same or greater exposure than human users. The practitioner conclusion is straightforward: if IAM does not govern NHIs, it is not governing the actual access estate.
A few things that frame the scale:
- 59% of compromised machines in a major 2025 supply chain attack were CI/CD runners rather than personal workstations, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: Should organisations prioritise JIT access over broad entitlement cleanup?
A: Organisations should prioritise JIT access when the immediate problem is persistent operational privilege, because it directly shortens the exposure window. Entitlement cleanup still matters, but JIT changes day-to-day risk faster by ensuring access exists only when the task requires it.
👉 Read our full editorial: Identity and access management tools now must govern NHIs