Notifications
Clear all
Topic starter
06/06/2026 2:02 am
TL;DR: Financial services now depend on service accounts, APIs, bots, and machine-learning processes, but traditional IAM built for humans is not designed to manage that scale or lifecycle, according to Oasis Security. In practice, visibility, secret rotation, and least privilege have become the controls that determine whether NHIs stay governable or turn into a breach path.
NHIMG editorial — based on content published by Oasis Security: Securing Non-Human Identities for Financial Services
By the numbers:
- NHIs outnumber human identities by 25x to 50x in modern enterprises.
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
- 85% of organisations lack full visibility into third-party vendors connected via OAuth apps - 38% have no or low visibility, and a further 47% have only partial visibility.
Questions worth separating out
Q: What breaks when machine identities are not governed like first-class identities?
A: Access becomes persistent, hard to attribute, and easy to overextend across systems.
Q: Why do NHIs complicate security governance in financial services?
A: They operate continuously, at machine speed, and across many connected systems, so human review cycles miss the moment when access becomes unsafe.
Q: How do security teams know if NHI controls are actually working?
A: Look for complete inventory coverage, clear ownership, enforced rotation, and evidence that unused credentials are removed on time.
Practitioner guidance
- Inventory machine identities across every environment Start with cloud, on-premises, and hybrid systems, then tie each service account, API key, token, and certificate to a business owner and an application dependency.
- Enforce secret rotation and expiry by design Set rotation rules for long-lived credentials and make revocation part of change management when an integration, vendor, or workflow changes.
- Reduce standing privilege on machine accounts Limit each NHI to the minimum rights needed for one workload, one pipeline, or one external connection.
What's in the full article
Oasis Security's full blog covers the operational detail this post intentionally leaves for the source:
- A white paper focused on financial-services use cases across cloud, on-premises, and hybrid environments.
- The vendor’s framing of lifecycle management, automated secret rotation, and least privilege for machine identities.
- Context on how the source positions NHI governance as a business continuity issue for regulated institutions.
- Additional examples tied to open banking, blockchain, and machine-learning processes.
👉 Read Oasis Security's analysis of securing non-human identities in financial services →
Non-human identities in financial services: where governance breaks down?
Explore further
06/06/2026 3:28 am
Financial services has turned NHI governance into a business continuity issue. When service accounts, APIs, and machine-learning processes sit inside revenue systems, access sprawl is no longer a back-office hygiene problem. The control question shifts from whether credentials exist to whether they can be discovered, owned, and removed before they outlive the process they support. Practitioners should treat NHI governance as operational resilience, not a narrow security add-on.
A few things that frame the scale:
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to the Ultimate Guide to NHIs.
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures.
A question worth separating out:
Q: Who is accountable when a machine credential is abused?
A: Accountability should sit with the team that owns the workload, the identity lifecycle, and the connected business process, not with security alone. In regulated environments, that usually means engineering, platform, and IAM teams share responsibility for discovery, rotation, and offboarding while compliance verifies that the process is repeatable.
👉 Read our full editorial: Securing non-human identities in financial services needs lifecycle control
