Notifications
Clear all
Topic starter
22/07/2026 4:35 pm
TL;DR: Enterprises are struggling to secure non-human identities because machine identities are being created inside CI/CD, Kubernetes, SaaS, and AI workflows faster than central IAM can inventory them, and many still keep more access than they need, according to Apono. Static governance is no longer enough; runtime discovery, just-enough access, and time-bound permissions are now the practical baseline.
NHIMG editorial — based on content published by Apono: Why 75%+ of Enterprises Admit They Can’t Secure Their Non-Human Identities
Questions worth separating out
Q: How should security teams govern non-human identities in cloud environments?
A: Start with complete discovery, because you cannot govern what you cannot see.
Q: Why do overprivileged service accounts create such persistent cloud risk?
A: Overprivileged service accounts create persistent risk because they combine standing access, weak ownership, and broad lateral movement potential.
Q: What do security teams get wrong about NHI visibility?
A: They often treat visibility as a reporting problem rather than a governance problem.
Practitioner guidance
- Inventory runtime-issued NHIs continuously Track service accounts, CI roles, OAuth scopes, federated trust relationships, and workload identities as they are created in pipelines and code, not only in central IAM records.
- Replace broad machine permissions with task-scoped access Limit each principal to the minimum API actions, resources, and environments required for the current workflow stage, then remove write access once the task is complete.
- Enforce expiry on privileged machine access Use time-bound permissions so elevated access exists only during the execution window, with automatic revocation before the workflow completes or retries.
What's in the full article
Apono's full article covers the operational detail this post intentionally leaves for the source:
- Practical examples of how NHIs are created inside CI/CD, Kubernetes, SaaS integrations, and AI-driven workflows.
- The runtime access model for just-enough permissions, including how time-bound access changes deployment behaviour.
- The article's implementation framing for discovery, contextual authorization, and auto-expiring access across modern cloud environments.
- The source's own discussion of Slack, Teams, CLI, and API-driven enforcement for developer-facing access workflows.
👉 Read Apono's analysis of why NHI security is shifting to runtime enforcement →
NHI security at runtime: are your controls keeping up?
Explore further
24/07/2026 4:11 pm
Runtime identity governance is now the primary control plane for NHI security. Static IAM was built for principals that could be inventoried before access was granted, but modern machine identities are created inside delivery systems and exercised at runtime. That changes the governance problem from entitlement review to runtime enforcement, because the access event is now the unit of risk. Practitioners should treat identity discovery, approval, and expiration as one operational loop rather than three separate processes.
A few things that frame the scale:
- Only 19.6% of security professionals express strong confidence in their organisation's ability to securely manage non-human workload identities, according to The 2024 Non-Human Identity Security Report.
- 88.5% of organisations acknowledge that their non-human IAM practices lag behind or are merely on par with their human identity and access management efforts, which shows the maturity gap is still structural.
A question worth separating out:
Q: How do identity teams reduce blast radius for non-human identities?
A: Limit credential scope, separate duties across workloads, and ensure every identity has a clear offboarding path. The goal is to stop one compromised or over-privileged service from becoming the trust bridge into many other systems, which is where many cloud incidents spread.
👉 Read our full editorial: NHI security is shifting from governance to runtime enforcement
