Notifications
Clear all
Topic starter
25/06/2026 1:12 am
TL;DR: Non-human identities now drive most system-to-system communication, with IDC saying 95% of enterprise traffic is machine-to-machine, while exposed keys, over-privileged accounts, and unmanaged certificates keep expanding the attack surface, according to Silverfort. Static IAM models no longer fit the scale or speed of NHI use, and Zero Trust only works if machine identities are treated as first-class governed assets.
NHIMG editorial — based on content published by Silverfort: non-human identity security under Zero Trust
By the numbers:
- 95% of all enterprise system-to-system communications are now conducted by NHIs.
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities.
Questions worth separating out
Q: How should security teams govern non-human identities across cloud and on-premises environments?
A: Start with a complete inventory of service accounts, API keys, certificates, and workload identities, then assign ownership, purpose, expiry, and revocation responsibility to each one.
Q: Why do non-human identities complicate Zero Trust architecture?
A: Because Zero Trust assumes every request can be verified in context, but many machine credentials are long-lived, embedded, and invisible to human-style controls such as MFA and behavioural prompts.
Q: What breaks when service accounts have standing privilege?
A: Standing privilege turns a compromised machine credential into durable access that can outlive the original task, system change, or vendor relationship.
Practitioner guidance
- Inventory every machine identity across platforms Build a continuously updated register of service accounts, API keys, certificates, tokens, and workload identities across cloud, on-premises, CI/CD, and IoT environments.
- Replace long-lived credentials with ephemeral access Phase out static secrets where workloads can use short-lived tokens, certificate-based trust, or federated workload identity.
- Tie lifecycle controls to deployment workflows Make issuance, rotation, and revocation part of CI/CD and infrastructure automation so credentials are not left for manual follow-up.
What's in the full article
Silverfort's full article covers the operational detail this post intentionally leaves for the source:
- A fuller walkthrough of how service accounts, API keys, certificates, and workload identities fit into enterprise environments.
- The article's practical Zero Trust roadmap for inventory, ownership, monitoring, and lifecycle automation.
- Examples of how CIA-style machine identity controls map into cloud, container, and IoT environments.
- The vendor's discussion of operational trade-offs when teams move from static credentials to ephemeral authentication.
👉 Read Silverfort's analysis of non-human identity security under Zero Trust →
NHI governance and Zero Trust: are your controls keeping up?
Explore further
25/06/2026 10:28 am
NHI governance fails when machine identity is treated as a secondary control plane. The article describes a world where workloads, pipelines, APIs, and devices already outnumber people in operational significance. That means identity governance built around user logins, MFA prompts, and periodic access reviews misses the system that actually moves data and triggers action. The practitioner conclusion is that machine identity must be governed as the primary perimeter, not as an exception case.
A few things that frame the scale:
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, according to The 2024 ESG Report: Managing Non-Human Identities.
- Enterprises that have experienced a compromised NHI averaged 2.7 separate incidents in the past 12 months, showing that machine identity failures are rarely one-off events.
A question worth separating out:
Q: What should organisations do first when modernising NHI governance?
A: Prioritise the identities that can reach critical data or production systems, then eliminate static secrets, automate rotation, and enforce ownership. The first objective is not perfection, but reducing hidden access paths and making every credential accountable. That creates the basis for stronger Zero Trust enforcement and better lifecycle control.
👉 Read our full editorial: Non-human identity governance is now the Zero Trust boundary
