Notifications
Clear all
Topic starter
06/06/2026 1:59 am
TL;DR: PAM can control privileged human accounts, but it struggles with non-human identities created outside HR and AD workflows, lacking authoritative ownership, lifecycle context, and standardized formats across clouds, according to Oasis Security. The governance boundary is structural: service accounts and API keys need NHI-specific visibility, rotation, and offboarding, not a human-admin control plane.
NHIMG editorial — based on content published by Oasis Security: How does Non Human Identity complement Privileged Access Management for 360-degree security?
By the numbers:
- NHIs outnumber human identities by 25x to 50x in modern enterprises.
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
- Only 5.7% of organisations have full visibility into their service accounts.
Questions worth separating out
Q: How should security teams govern service accounts that PAM does not fully cover?
A: They should treat service accounts as a separate identity class with explicit ownership, lifecycle states, and rotation rules.
Q: Why do non-human identities complicate privileged access management?
A: Because PAM was built around human identities tied to authoritative sources such as HR and Active Directory.
Q: What breaks when service accounts have no clear owner or offboarding process?
A: Access outlives the workload that needed it, which turns a temporary integration credential into standing exposure.
Practitioner guidance
- Separate human and machine privileged access inventories Classify administrator accounts, service accounts, API keys, tokens, and certificates into different governance tracks.
- Map ownership and consumer relationships for every NHI Record the application, workload, or pipeline that uses each identity, plus the business owner and technical custodian.
- Standardise lifecycle states for machine identities Define creation, active use, rotation, suspension, and retirement as explicit states for service accounts and secrets.
What's in the full article
Oasis Security's full blog covers the operational detail this post intentionally leaves for the source:
- A fuller explanation of how its NHI management platform discovers machine identities across cloud, SaaS, and secret-management systems.
- Context-correlation examples showing how the vendor maps ownership, consumers, and resources to individual non-human identities.
- Operational detail on automated remediation for secret rotation, stale account decommissioning, and offboarding workflows.
- A worked comparison of how NHI management complements existing PAM investments in enterprise IAM stacks.
👉 Read Oasis Security's analysis of why PAM does not fully manage non-human identities →
PAM and NHI management: where the governance boundary really is?
Explore further
06/06/2026 3:24 am
PAM was designed for privileged human accounts, not for the distributed identity fabric of cloud infrastructure. The model assumes an authoritative identity source, a single accountable user, and a well-structured provisioning workflow. NHIs break all three assumptions because they are created ad hoc in engineering workflows and often persist without a formal lifecycle owner. The implication is that PAM remains necessary, but it cannot be the universal control plane for privileged access.
A few things that frame the scale:
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to the Ultimate Guide to NHIs.
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures.
A question worth separating out:
Q: Should organisations use PAM and NHI governance together?
A: Yes. PAM should continue to manage human privileged sessions, while NHI governance should handle machine identity discovery, ownership, rotation, and retirement. The two control sets overlap in the privileged domain but solve different identity problems, so using only one leaves blind spots.
👉 Read our full editorial: PAM complements NHI governance, but the identity model is different
