Topic starter
24/06/2026 9:07 pm
TL;DR: As machines, APIs, bots, and IoT devices outnumber human users, SPHERE argues that non-human identities are becoming a primary cybersecurity blind spot, with attackers exploiting weak ownership, poor visibility, and inadequate entitlement oversight. The governance model now has to shift from account inventory to identity intelligence, or NHI risk will keep outrunning conventional IAM controls.
Editorial analysis by NHI Mgmt Group, based on content published by SPHERE: “The Impact of the Exponential Growth of Non-Human Identities”.
Key questions
Q: What breaks when non-human identity ownership is unclear?
A: When ownership is unclear, rotation stalls, reviews default to approval, and nobody feels safe removing access.
Q: Why do machine identities create more risk than human identities in some environments?
A: Machine identities are often numerous, long-lived, and embedded in code or infrastructure.
Q: How do teams know if NHI governance is actually working?
A: Look for complete inventory coverage, clear ownership, enforced rotation, and reliable decommissioning.
Practitioner guidance
- Build a complete NHI ownership map Tie every bot, API, device, and service account to a named business or technical owner, then make ownership a required field for review and offboarding.
- Audit entitlements against real service purpose Certify NHI access by linking each privilege set to the workload, integration, or automation task it supports, and remove access that lacks an active use case.
- Track certificates, keys, and tokens as governance objects Treat machine credentials as lifecycle assets that need rotation, revocation, and exception handling, not as static technical details buried in configuration.
Bottom line: Non-human identities have become a governance blind spot because traditional IAM models still prioritise human accounts and human review patterns.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 6:08 am
NHI ownership is now the control plane, not a back-office detail. When machines, bots, APIs, and devices outnumber people, ownership determines whether an identity can be reviewed, revoked, or investigated at all. SPHERE's argument is directionally correct: the first governance failure is not weak policy but unclear accountability. Practitioners should treat ownership mapping as a foundational control for every NHI programme.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What is the difference between inventory and identity intelligence for NHIs?
A: Inventory lists what exists. Identity intelligence connects each NHI to ownership, entitlement context, usage patterns, and lifecycle state, so security teams can judge whether access still makes sense. For machine identities, that distinction matters because a static list does not show whether an identity is active, abandoned, or overprivileged.
👉 Read our full editorial: Exponential NHI growth is exposing identity governance blind spots