Topic starter
08/01/2026 12:36 pm
TL;DR: Machine identities now outnumber human users by more than 80 to 1, while only 15% of organisations feel highly confident preventing NHI attacks and 69% remain concerned, according to Apono. Static credentials, hardcoded secrets, and manual rotation leave a growing attack surface that traditional vault models do not fully contain.
Editorial analysis by NHI Mgmt Group, based on content published by Apono: “Secret Management: A Step-by-step Guide to NHI Security”.
By the numbers:
- Machine identities now outnumber human users by more than 80 to 1 in modern enterprises.
- Only 15% of organizations feel highly confident in preventing NHI attacks.
- 69% of organizations express concerns about NHI attacks.
Key questions
Q: What breaks when NHI secrets are stored in code or CI/CD systems?
A: You lose the containment boundary.
Q: Why do long-lived machine credentials create more risk than short-lived access?
A: Long-lived machine credentials create more risk because they can be copied, reused, and forgotten across pipelines and infrastructure.
Q: When do secrets managers fall short for NHI governance?
A: Secrets managers fall short when teams treat storage as the control, not the delivery decision.
Practitioner guidance
- Discover and classify every machine secret Inventory API keys, tokens, service accounts, and workflow credentials across repositories, pipelines, cloud variables, and containers.
- Replace static credentials with automatic expiry Move from manually rotated long-lived credentials to time-bound secrets that expire on schedule or on event.
- Scope access to one workload or function Break shared service accounts apart and issue workload-specific identities for each pipeline, namespace, or service.
Bottom line: Secrets management gaps widen machine identity risk when credentials are copied into code, pipelines, and cloud variables without clear ownership or expiry.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 5 days ago by NHI Mgmt Group
06/10/2026 11:37 pm
Secrets management is now the control plane for NHI governance, not a supporting utility. When machine identities outnumber human users by orders of magnitude, the old assumption that credentials can be tracked manually collapses. The governance task becomes lifecycle control over every secret's owner, scope, and expiry, because that is where NHI access actually lives. Practitioners should stop treating vaulting as the whole answer and start treating it as one control in a broader NHI programme.
A few things that frame the scale:
- 28.65 million new hardcoded secrets were detected in public GitHub commits in 2025 alone, a 34% year-over-year increase and the largest single-year jump ever recorded, according to the State of Secrets Sprawl 2026.
- Only 44% of organisations are currently using a dedicated secrets management system, according to the 2024 State of Secrets Management Survey.
A question worth separating out:
Q: When should organisations move from service accounts to workload identities?
A: They should move when an account is used for unattended cloud operations, scripted administration, or infrastructure provisioning. In those cases, managed identities or service principals usually fit the execution model better because they avoid human sign-in assumptions and reduce the chance that MFA policy will disrupt business operations.
👉 Read our full editorial: Secrets management gaps are widening machine identity risk