Topic starter
29/09/2025 9:56 am
TL;DR: Non-human identities now outnumber humans 144:1, 43% of exposed secrets are found outside code, and 1 in 20 AWS machine identities carry full admin privileges, according to Entro Security’s H1 2025 report, showing that conventional identity controls are no longer containing machine sprawl. The governance problem is structural: ownership, sightlines, and blast-radius reduction now matter more than vaulting alone.
Editorial analysis by NHI Mgmt Group, based on content published by Entro Security: “NHI & Secrets Risk Report – H1 2025”.
By the numbers:
- Non-human identities now outnumber humans 144:1 in the report’s H1 2025 snapshot.
Key questions
Q: What breaks when secrets are still stored outside managed vaults?
A: Secrets become easy to reuse across humans, scripts, and agents without a consistent audit trail.
Q: Why do over-privileged identities increase breach impact?
A: Over-privileged identities expand the damage a stolen credential can do because the attacker inherits more pathways into sensitive systems.
Q: How can organisations tell whether NHI governance is actually working?
A: NHI governance is working when every machine identity has an owner, a purpose, a minimum-necessary entitlement, and evidence of rotation and review.
Practitioner guidance
- Inventory machine identities by owner and privilege Build a current register of service accounts, API keys, tokens, and certificates with explicit ownership and business purpose.
- Expand secret discovery beyond source code Search collaboration platforms, shared files, tickets, endpoints, and messaging systems for exposed credentials, not just repositories and CI logs.
- Remove full admin rights from machine identities Review cloud roles attached to machine identities and replace standing admin access with task-scoped permissions.
Bottom line: The report describes a control environment where machine identities, exposed secrets, and privilege scope are expanding faster than traditional IAM review cycles can absorb.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
06/10/2026 4:37 pm
Secrets management has become a governance problem, not just a vaulting problem. The report shows exposed secrets appearing outside code, which means source-control scanning and vault adoption no longer cover the full exposure surface. The more important question is whether organisations can see where credentials actually live, who owns them, and whether they are still valid. Practitioners should treat secret visibility as a lifecycle control spanning code, collaboration, and endpoint environments.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What is the difference between secret rotation and NHI offboarding?
A: Rotation changes the credential while the identity stays active. Offboarding removes the identity or proves it is no longer needed. Teams often confuse the two and rotate obsolete credentials instead of retiring them. Good governance uses both, but offboarding is what eliminates unused access and reduces long-term attack surface.
👉 Read our full editorial: NHI and secrets risk is widening as exposed identities outnumber humans