Notifications
Clear all
Topic starter
12/06/2026 9:59 pm
TL;DR: NHIs outnumber human users by 10x or more in many organisations, and Netwrix argues that ad hoc creation, broad permissions, weak monitoring, and poor decommissioning leave them unmanaged across the lifecycle. The real issue is not volume alone but governance built for human identities that breaks when applied to machine identities.
NHIMG editorial — based on content published by Netwrix: Managing the non-human identity lifecycle in modern environments
By the numbers:
- NHIs outnumber human identities by 25x to 50x in modern enterprises.
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
- 91% of former employee tokens remain active after offboarding, leaving organisations vulnerable to potential security breaches.
Questions worth separating out
Q: How should security teams manage the lifecycle of non-human identities?
A: Security teams should manage non-human identities through discovery, ownership, least privilege provisioning, continuous monitoring, rotation, and decommissioning.
Q: Why do non-human identities create more governance risk than many human accounts?
A: Non-human identities often outnumber human users, are created outside formal HR workflows, and can accumulate standing privilege without periodic review.
Q: What breaks when NHIs are not rotated or decommissioned properly?
A: When NHIs are not rotated or decommissioned, old credentials remain valid after the service, project, or owner has changed.
Practitioner guidance
- Inventory every machine identity across all environments Use discovery across cloud, SaaS, CI/CD, and legacy systems to identify service accounts, API keys, certificates, tokens, and workload identities.
- Set least privilege at creation time Require minimum permissions, an explicit owner, and an expiry or review date before any NHI is promoted into production.
- Link monitoring to revocation workflows Correlate usage patterns, access scope changes, and dormant identities with automated removal or escalation paths.
What's in the full article
Netwrix's full blog covers the operational detail this post intentionally leaves for the source:
- A stage-by-stage lifecycle model for discovery, provisioning, monitoring, rotation, and decommissioning.
- Practical examples of service accounts, API keys, certificates, and automation identities in common enterprise environments.
- Specific provisioning pitfalls such as copied permissions, undocumented ownership, and overly broad access.
- A fuller treatment of the monitoring signals that help distinguish normal usage, drift, and dormant credentials.
👉 Read Netwrix's guide to managing the non-human identity lifecycle →
NHI lifecycle management in modern environments: what teams miss?
Explore further
13/06/2026 12:26 am
Lifecycle governance for NHIs is now an access-control problem, not a tooling problem. The article shows that discovery, provisioning, monitoring, rotation, and decommissioning are all linked stages, and failure in one stage undermines the rest. Identity governance teams should treat machine identities as a first-class governed asset class, because unmanaged lifecycle state becomes unmanaged access state.
A few things that frame the scale:
- 91% of former employee tokens remain active after offboarding, leaving organisations vulnerable to potential security breaches, according to The 2025 State of NHIs and Secrets in Cybersecurity.
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Who should own non-human identity governance in an organisation?
A: Non-human identity governance usually sits across IAM, cloud, DevOps, and application owners, but each identity still needs a single accountable owner. Without one owner per identity, recertification, rotation, and revocation become unclear, and abandoned credentials are much harder to remove.
👉 Read our full editorial: Managing the non-human identity lifecycle in modern environments
