Topic starter
24/06/2026 11:43 pm
TL;DR: Machine identities often outnumber human users 10 to 1, and SailPoint’s Horizons of Identity Security Report 2024-25 links that growth to dormant credentials and audit issues. Identity programmes need tighter lifecycle control or persistent machine access will keep widening exposure.
Editorial analysis by NHI Mgmt Group, based on content published by SailPoint: “Identity at the helm: Why cyber resilience starts with modern identity security”.
By the numbers:
- Machine identities now often outnumber human users 10 to 1.
- 30%+ growth in machine identities is expected within the next 3 to 5 years.
- 72% of companies surveyed admit to intentionally retaining dormant machine identities.
Key questions
Q: Why do dormant machine identities create so much security risk?
A: Dormant machine identities are risky because they remain valid even after the business need has passed.
Q: How do teams know if machine identity governance is actually working?
A: Look for evidence that each service account has a current owner, a narrow purpose, a short credential lifetime, and a clear retirement path.
Q: What breaks when orphaned machine identities are left in place?
A: Orphaned identities break accountability first and containment second.
Practitioner guidance
- Map every machine identity to a named owner Require a business or technical owner for each service account, token, or workload identity so accountability survives staff changes and platform drift.
- Remove dormant identities on a fixed lifecycle trigger Define expiry, revocation, or revalidation triggers for machine identities that are no longer tied to an active workload or third-party relationship.
- Reduce standing privilege in machine access paths Review overprovisioned access across machine and third-party identities, then narrow scopes to the minimum needed for current runtime use.
Bottom line: Machine identity sprawl is no longer a narrow IAM issue because it directly affects resilience, auditability, and breach exposure.
Glossary terms: Identity maturity, Machine Identity Sprawl, Dormant Machine Identity, Identity Blast Radius
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
25/06/2026 8:39 am
Identity maturity is now a resilience control, not an IAM scorecard: The article correctly shifts the conversation away from process completion and toward operational survivability. When machine identities outnumber human users and continue to grow, the question becomes whether access can be governed continuously enough to survive misuse, audit pressure, and incident response demands. Practitioners should treat maturity as a resilience metric, not a reporting label.
A question worth separating out:
Q: Should organisations prioritise machine identity maturity before expanding automation?
A: Yes, because automation multiplies the number and speed of machine identities without automatically improving governance. If identity ownership, lifecycle control, and privilege scope are weak, automation spreads the same risk faster. Organisations should stabilise machine identity governance first so automation does not simply scale unmanaged access.
👉 Read our full editorial: Identity maturity and machine identity risk are driving cyber resilience