Notifications
Clear all
Topic starter
07/06/2026 8:45 pm
TL;DR: The 2025 IDSA Trends in Identity Security Report says machine identities now outnumber human users, AI-driven attacks are rising, and 512 identity and security professionals were surveyed to benchmark what is working and where control gaps persist. The real shift is that identity programmes must govern automated and machine-based access, not just users.
NHIMG editorial — based on content published by Bravura Security: the 2025 IDSA Trends in Identity Security Report
By the numbers:
- The report benchmarks responses from 512 identity and security professionals.
- The report says 43 percent of incidents could have been prevented by specific identity controls.
Questions worth separating out
Q: How should security teams govern machine identities at enterprise scale?
A: Start with discovery, ownership, and lifecycle control.
Q: Why do machine identities increase identity risk compared with human accounts?
A: Machine identities increase risk because they are numerous, long-lived, and often embedded in applications or pipelines where they are hard to see.
Q: What do teams get wrong when reviewing non-human access?
A: The most common mistake is using human-centric review processes for machine identities.
Practitioner guidance
- Inventory machine identities by owner and use case Build a living register of service accounts, API keys, tokens, and certificates with business owner, technical owner, system dependency, and renewal path.
- Reduce long-lived credential exposure Prioritise the identities most likely to be copied into code, config files, and automation jobs, then move them into managed secrets workflows with explicit rotation and expiry.
- Rework recertification for non-human access Do not reuse human access review templates for machine accounts.
What's in the full report
Bravura Security's full report covers the operational detail this post intentionally leaves for the source:
- Survey cuts that show where identity leaders are planning to invest in 2025 and beyond.
- The underlying charts behind the 512-professional benchmark and the control themes respondents prioritised.
- The report's fuller breakdown of which identity controls would have prevented 43 percent of incidents.
- The practical data behind what practitioners said is slowing identity teams down operationally.
👉 Read Bravura Security's 2025 identity security trends report →
Machine identities vs human users: what IAM teams need to know?
Explore further
08/06/2026 8:25 am
Machine identity growth is now the pacing factor in identity security programmes. The report reinforces a structural shift that many teams still understate: access no longer scales primarily through users, it scales through service accounts, tokens, and machine-to-machine integration. That means inventory, ownership, and lifecycle governance become the real control plane. The practical conclusion is that identity programmes that still centre human users will continue to miss the largest part of their exposure.
A few things that frame the scale:
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, which shows why machine identity inventory remains a structural weakness.
A question worth separating out:
Q: Should organisations prioritise Zero Trust for machine identities before broader IAM changes?
A: Yes, if machine identities are already driving a large share of your access surface. Zero Trust is most useful when it constrains the identities that can move laterally, call services, or carry long-lived privileges. If those identities remain over-privileged or unmanaged, broader IAM improvements will still leave the highest-risk access paths exposed.
👉 Read our full editorial: Machine identities are overtaking human users in identity security
