Topic starter
12/06/2026 12:21 am
TL;DR: Non-human identities now outnumber human users by as much as 50 to 1 in many organisations, and Cerbos cites a 2024 Cloud Security Alliance survey showing that 1 in 5 organisations have already had an NHI-related incident while only 15% feel confident securing them. That gap makes machine identity governance a board-level liability, not an IT housekeeping problem.
Editorial analysis by NHI Mgmt Group, based on content published by Cerbos: “The ROI of NHI security: Why investing in machine identity protection pays off”.
By the numbers:
- 1 in 5 organisations reported a security incident related to non-human identities.
- Only 15% of companies felt confident in their ability to secure those machine identities.
- Credentials-related breaches cost organisations $4.62 million on average, according to IBM data cited by Cerbos.
Key questions
Q: How should security teams govern non-human identities at scale?
A: Security teams should treat non-human identities as a lifecycle problem with ownership, review, rotation, and revocation built in from the start.
Q: Why do unowned service accounts create more security risk?
A: Unowned service accounts create more risk because no one is responsible for reviewing their permissions, rotating their credentials, or removing them when they are no longer needed.
Q: What breaks when machine credentials are not rotated?
A: When machine credentials are not rotated, stale access accumulates and the organisation loses confidence that the secret still reflects the intended scope.
Practitioner guidance
- Define ownership for every machine identity Assign a named business and technical owner to each service account, API token, bot, and key so that lifecycle decisions are traceable.
- Inventory credentials across all environments Build a current register of non-human identities across cloud, CI/CD, and production systems, including where each credential is used and what it can reach.
- Reduce standing access scope Trim machine permissions to the smallest viable set so a stolen token cannot access customer data, secrets, or adjacent production services.
Bottom line: Non-human identities are a governance problem because valid machine access can be used to reach production systems and sensitive data without bypassing authentication controls.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 5 days ago by NHI Mgmt Group
12/06/2026 9:32 am
Machine identity governance is now a board issue because the attack surface is operational, not theoretical. NHIs are embedded in production workflows, customer integrations, and cloud automation, so their failure modes translate directly into downtime, disclosure, and compliance exposure. Boards do not need to understand every token type to understand the risk: if machine access is unowned or over-scoped, the business is carrying hidden operational liability.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What does good NHI governance look like for audit and compliance purposes?
A: For audit and compliance, good NHI governance requires four capabilities: complete inventory (demonstrating knowledge of all NHIs including informally created ones), ownership accountability (every NHI has an identified current owner), access control discipline (NHIs have minimum necessary permissions with regular reviews and documented findings), and audit trail integrity (ability to reconstruct what any NHI did at any point within the regulatory retention period).
👉 Read our full editorial: NHI security risks are now a board-level business liability
This post was modified 5 days ago by NHI Mgmt Group