Topic starter
25/06/2026 1:12 am
TL;DR: Non-human identities now drive most system-to-system communication, with IDC saying 95% of enterprise traffic is machine-to-machine, while exposed keys, over-privileged accounts, and unmanaged certificates keep expanding the attack surface, according to Silverfort. Static IAM models no longer fit the scale or speed of NHI use, and Zero Trust only works if machine identities are treated as first-class governed assets.
Editorial analysis by NHI Mgmt Group, based on content published by Silverfort: “Non-human identities and zero trust: The next evolution in identity security”.
By the numbers:
- According to IDC, 95% of all enterprise system-to-system communications are now conducted by NHIs.
Key questions
Q: What breaks when non-human identities are governed like human users?
A: Lifecycle triggers, ownership, and review processes stop working because machine identities do not generate joiner, mover, or leaver events.
Q: Why do long-lived machine credentials increase breach risk?
A: Long-lived credentials create a standing access path that can survive code changes, personnel changes, and forgotten integrations.
Q: What are the signs that NHI governance is failing in an enterprise?
A: Common warning signs include unclear ownership for service accounts, secrets stored in code or configuration instead of managed vaults, infrequent rotation, and weak offboarding of API keys.
Practitioner guidance
- Inventory every machine identity Build a complete inventory of service accounts, API keys, tokens, certificates, cloud roles, and other NHIs across cloud, on-premises, CI/CD, and IoT environments.
- Replace standing credentials with short-lived access Migrate static secrets toward short-lived credentials, certificate-based authentication, or workload identity patterns that expire automatically and narrow the attack window.
- Assign explicit ownership and lifecycle policies Require every NHI to have a responsible team and a documented lifecycle policy covering rotation, inactivity handling, and deactivation after use.
Bottom line: Non-human identities have become the practical boundary of Zero Trust, because machine traffic now dominates how modern systems communicate.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 10:28 am
Zero Trust for NHIs is really a governance boundary, not a network design choice. The article is strongest when it shows that machine identities already carry most system-to-system traffic, which makes them the practical control point for access decisions. If organisations do not govern NHIs as first-class identities, Zero Trust remains human-centric theater. The practitioner implication is that identity governance now has to reach workloads, pipelines, APIs, and devices together.
A few things that frame the scale:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
- The 2025 Gartner Machine Identity Management in a Hybrid, Automated AI World Survey showed that 32% of organizations use mostly automated methods to manage credentials and only 1% use fully automated methods.
A question worth separating out:
Q: How should teams enforce Zero Standing Privilege for workloads?
A: Teams should grant machine access only for the task being executed, then remove it automatically when the task ends or the workload becomes inactive. That means tying entitlements to workload purpose, not convenience, and making revocation part of the deployment and operations flow. Persistent machine access should be the exception, not the design default.
👉 Read our full editorial: Non-human identity governance is now the Zero Trust boundary