Notifications
Clear all
Topic starter
14/07/2026 4:23 pm
TL;DR: Most enterprise identities are now non-human, and recent studies cited by Identra show machine identities outnumber human ones by tens to more than 100 per person; the article argues that inventory, vaulting, and posture scanning do not answer who acted, with what authority, and on whose behalf. The governance gap is structural, because machine authority can outlive ownership, context, and runtime visibility.
NHIMG editorial — based on content published by Identra.ai: The Non-Human Majority
By the numbers:
- Recent industry studies report tens to more than 100 machine identities per human, depending on what is counted and the environment measured.
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases.
Questions worth separating out
Q: How should security teams govern machine identities in industrial environments?
A: Security teams should govern machine identities the same way they govern privileged access: assign an owner, define a specific purpose, limit scope, and review it continuously.
Q: What problem does ownership attribution solve for service accounts and API keys?
A: It closes the gap between exposure detection and accountable remediation.
Q: What breaks when organisations cannot see all of their non-human identities?
A: What breaks is governance itself.
Practitioner guidance
- Separate principal, credential, grant, runtime, resource, and owner Stop treating a secret as the identity itself.
- Map reachable blast radius, not just inventory counts Model effective paths from each machine identity to sensitive APIs, datasets, and automation targets.
- Bind lifecycle controls to every non-human principal Require explicit creation, ownership, renewal, and retirement for service accounts, tokens, and agent identities.
What's in the full article
Identra.ai's full article covers the operational detail this post intentionally leaves for the source:
- The article's six-object identity model and the practical distinction between principal, credential, grant, runtime, resource, and accountability context.
- The full argument for why machine identities break human IAM assumptions across lifecycle, context, and runtime speed.
- The complete conceptual model for reachability and blast radius, including the relationship between potential, effective, and observed access.
- The closing operational framework for resolving every identity fragment back to one accountable control plane.
👉 Read Identra.ai's analysis of the non-human majority and identity accountability →
Non-human identity sprawl: what IAM teams are missing?
Explore further
14/07/2026 4:31 pm
The non-human majority is now the primary identity governance problem. When most authority sits with workloads, service accounts, tokens, and agents, human-centric IAM controls stop being the main line of defense. The programme has to govern machine identity as a first-class discipline, not as a collection of secrets to be stored and rotated. Practitioners should treat NHI governance as core identity architecture, not a tooling side task.
Identity blast radius is becoming the practical metric that matters. As machine authority spreads across services, SaaS, and agent runtimes, the programme risk is no longer how many identities exist but how far any one of them can reach. If your team cannot trace effective reach from principal to resource, you do not yet have a governable identity estate.
A question worth separating out:
Q: What should teams do when machine identities can act at runtime without human review?
A: Teams should shift from static approval models to closed-loop runtime governance. The control objective is to detect and stop actions while the identity is still executing, because machine-speed decisions can outrun human review and leave no useful remediation window after the fact.
👉 Read our full editorial: The non-human majority is the identity problem IAM missed
