Topic starter
09/07/2026 3:19 pm
TL;DR: Non-human identities now outnumber human users by 144 to 1 and are growing 4 to 10 times faster, while fewer than 25% of organisations have formal policies for creating or decommissioning them, according to Commvault. The real governance problem is not just more machine accounts, but a machine-layer attack surface that traditional human-centric controls do not reliably see.
Editorial analysis by NHI Mgmt Group, based on content published by Commvault: “The Machine Identity Blind Spot Is Now a Primary Attack Surface”.
Key questions
Q: What breaks when voice phishing reaches machine identities?
A: The failure is that human recovery actions can authenticate the attacker into machine-layer credentials, after which passwords and MFA no longer help.
Q: Why do long-lived service accounts increase the impact of vishing?
A: They turn a short human compromise into durable machine access.
Q: What are the signs that NHI identity debt is becoming dangerous?
A: Watch for undocumented service accounts, credentials that have no named owner, tokens that survive project closure, and machine identities with permissions broader than the workload requires.
Practitioner guidance
- Map machine identity ownership Assign a named owner to every service account, token, OAuth grant, and API key, and require that owner to be accountable for business purpose, renewal, and retirement.
- Replace static secrets with short-lived credentials Use short-lived tokens and automatic rotation for credentials that currently persist across pipelines, integrations, and admin workflows.
- Correlate help desk events with identity changes Investigate MFA resets, password resets, and support desk interactions together with new token creation or privilege changes to identify human-to-machine pivot patterns.
Bottom line: NHI identity debt is a lifecycle problem that becomes an access problem when machine credentials outlive the projects and people that created them.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
09/07/2026 3:37 pm
Identity debt is now an attack surface, not an administrative backlog: The article is right to frame unmanaged NHIs as accumulated risk rather than simple sprawl. Years of provisioning without decommissioning create persistent access paths that behave like latent privilege, especially in cloud and SaaS estates. Practitioners should read NHI inventory gaps as exposure to abuse, not merely missing records.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
- Voice phishing was the most common initial infection vector in cloud intrusions in 2025 (23%) and the second most common across all intrusions (11%), according to Mandiant's M-Trends 2026.
A question worth separating out:
Q: How should IAM teams respond when a machine credential is abused?
A: They should revoke the credential, trace every dependent integration, and reset any linked privileges or trust relationships before the attacker can re-establish persistence. The response has to treat the credential as a live access path, not just a secret to be replaced.
👉 Read our full editorial: NHI identity debt is widening the attack surface for enterprises