Notifications
Clear all
Topic starter
25/08/2026 6:10 pm
TL;DR: Invisible keyholders create a governance blind spot for non-human identities, where credentials and access paths outgrow traditional visibility and lifecycle controls, according to Veza. That gap matters because identity programmes cannot govern what they cannot discover, certify, or revoke in time.
NHIMG editorial — based on content published by Veza: Invisible keyholders: the importance of Non-Human Identity Management
By the numbers:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job.
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security.
Questions worth separating out
Q: How should security teams find hidden non-human identities in cloud and application estates?
A: Start by correlating cloud inventories, CI/CD variables, secret stores, workload logs, and identity governance records.
Q: Why do invisible machine identities create more risk than human access reviews catch?
A: Human access reviews depend on visible records, predictable ownership, and stable review cadences.
Q: What breaks when non-human identity lifecycle processes are not automated?
A: Orphaned accounts, stale credentials, and delayed offboarding become normal.
Practitioner guidance
- Inventory hidden machine identities continuously Build a recurring process to discover service accounts, tokens, certificates, and embedded secrets across cloud, CI/CD, and application layers.
- Tie every NHI to a lifecycle owner Require an accountable owner for issuance, rotation, certification, and revocation of each non-human identity.
- Reduce effective permissions before recertification Review the actual actions a machine identity can perform, not just the role name attached to it.
What's in the full article
Veza's full article covers the operational detail this post intentionally leaves for the source:
- How the Access Graph surfaces hidden keyholders across applications, cloud services, and machine-to-machine relationships
- What the article says about least-privilege visibility gaps and how they show up in real access estates
- Operational examples of how teams can identify non-human identities that are not registered in standard IAM processes
- The specific access patterns Veza says practitioners should examine when hidden machine credentials are suspected
👉 Read Veza's analysis of invisible keyholders and non-human identity management →
Invisible keyholders: what IAM teams are missing in NHI governance?
Explore further
25/08/2026 6:11 pm
Invisible keyholders are a discovery failure before they are a privilege failure. When teams cannot inventory service accounts, tokens, and delegated access paths, every downstream governance control starts from partial truth. That means recertification, access reviews, and offboarding are all operating on an incomplete estate, which is why hidden NHI access becomes a structural blind spot rather than a point-in-time exception.
Invisible keyholders create governance debt that compounds faster than human IAM debt. Once machine credentials are scattered across cloud services and pipelines, the burden shifts from periodic review to continuous discovery. With 67% of organisations still relying heavily on static credentials despite the risks they pose to agentic AI deployments, the control problem is already broader than most programmes admit.
A question worth separating out:
Q: Who should own non-human identity governance in an enterprise?
A: It should be shared across IAM, security, finance and the business owner for the workload. Central teams define policy and evidence, but operational ownership has to sit with the process owner who can justify access, approve exceptions and confirm retirement.
👉 Read our full editorial: Invisible keyholders expose the non-human identity control gap
