Topic starter
06/07/2026 9:45 am
TL;DR: NHIs now outnumber human users by 45:1 to 100:1 in cloud environments, while 95% of cloud identities are over-privileged and 80% of breaches involve compromised identities, according to Andromeda Security. The control problem is no longer secret rotation alone. Blast-radius reduction, ownership, and lifecycle governance are now the decisive variables in NHI security.
Editorial analysis by NHI Mgmt Group, based on content published by Andromeda Security: “The Non-Human Identity Security Crisis”.
By the numbers:
- NHIs outnumber human users anywhere from 45:1 to 100:1 in cloud environments.
- 95% of cloud identities are over-privileged.
Key questions
Q: What breaks when non-human identities have more access than they need?
A: When non-human identities carry excess access, a single compromise can move from a local incident to broad cloud control.
Q: How do overprivileged NHIs increase breach impact in cloud environments?
A: They widen the blast radius because attackers can use one compromised credential to move laterally, access adjacent systems, and persist through new accounts or modified configurations.
Q: How should teams decide which NHI controls to fix first?
A: Start with inventory and ownership, then move to privilege reduction and offboarding.
Practitioner guidance
- Discover every NHI across cloud estates Build a complete inventory of service accounts, workload identities, API keys, certificates, and tokens before trying to optimize privileges or rotation.
- Right-size entitlements continuously Review effective permissions against actual usage and remove unused or excessive access so compromise cannot spread across broad cloud permissions.
- Attach human ownership to every NHI Assign a named sponsor for creation, review, and decommissioning so orphaned identities do not persist after employees, vendors, or processes change.
Bottom line: Non-human identity sprawl is not a niche cloud hygiene issue. It is a control problem that widens attack surface whenever service accounts and machine credentials outgrow governance.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/07/2026 10:02 am
Blast-radius governance is now the real NHI control plane: the article makes clear that the central risk is not whether an NHI exists, but how much it can do if compromised. When 95% of cloud identities are over-privileged, the security question becomes how much damage a single credential can cause before it is discovered. Practitioners should treat entitlement scope as the primary reduction lever, because credential rotation alone does not shrink the impact window.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
- 68% of organisations do not know how to fully address NHI risks, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How do organisations know whether NHI governance is working?
A: Governance is working when every machine identity has a known owner, a clear purpose, visible entitlements, and a defined retirement path. If service accounts remain unclassified, secrets are embedded in code, or credentials outlive the workload they support, the programme is still operating with blind spots.
👉 Read our full editorial: Non-human identity risk is outpacing cloud governance controls