Topic starter
16/01/2026 3:40 pm
TL;DR: Machine IAM now spans APIs, DevOps, AI pipelines, robotic process automation, and service accounts, according to One Identity, while 12.8 million secrets were publicly exposed on GitHub in 2023 and 17% to 25% of organisations have seen machine-identity incidents. The governance challenge is no longer whether non-human identities matter, but whether identity programmes can control privilege, lifecycle, and standards at machine scale.
Editorial analysis by NHI Mgmt Group, based on content published by One Identity: “Unify your identity platform: Address the IAM trends”.
By the numbers:
- 12.8 million secrets were publicly exposed on GitHub in 2023, a 28% increase from 2022.
- 17 to 25% of organisations have experienced security incidents related to machine identities.
- 36% of organisations have a hybrid approach to identity and access decision rights in the last 2 years.
Key questions
Q: What breaks when machine identities are governed separately from human IAM?
A: Separate governance creates blind spots in entitlement review, revocation, and monitoring.
Q: Why do machine identities increase outage risk in hybrid environments?
A: Hybrid environments multiply certificates, secrets, and keys across clouds and platforms, so expiry or misconfiguration in one place can interrupt dependent services elsewhere.
Q: What are the signs that production NHI governance is too weak?
A: Common warning signs include shared service credentials, secrets that remain valid across deployments, metadata access that is broadly reachable from workloads, and service accounts with permissions unrelated to their runtime function.
Practitioner guidance
- Map all non-human identities to accountable owners Build an inventory that separates service accounts, API keys, RPA identities, workload identities, and AI-linked credentials, then assign operational ownership and business purpose to each.
- Reduce standing privilege in machine identity estates Review machine accounts for privileges that persist beyond the task they support, and replace permanent access with narrower scopes and governed exception handling.
- Centralise secret lifecycle controls Track where secrets are created, stored, copied, and rotated so revocation can follow the credential across repositories, pipelines, and runtime environments.
Bottom line: Machine identities are now a central governance problem because APIs, service accounts, and automation pipelines create access risk at enterprise scale.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 5 days ago by NHI Mgmt Group
08/10/2026 5:09 pm
Machine IAM is no longer a niche subdomain of identity governance. Once service accounts, APIs, RPA, and AI pipelines make up a large share of the identity estate, the programme centre of gravity shifts from human directory hygiene to non-human credential governance. That means ownership, lifecycle, and privilege scope become the primary operating questions, not side concerns. The implication is that IAM leaders who still treat NHIs as an edge case are already behind the operating model the article describes.
A few things that frame the scale:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
- 42% of machine identities have privileged access and 61% of organisations lack identity security controls for cloud workloads, according to CyberArk's 2025 Identity Security Landscape.
A question worth separating out:
A: Security teams should treat machine identities as first-class identities, not secondary technical artifacts. That means applying governance, access review, lifecycle controls, and privileged access discipline to service accounts, API keys, bots, and workload identities. Cloud shared responsibility does not remove customer accountability for identity sprawl, over-privilege, or unmanaged access paths. Behavioral and anomaly-based analytics help spot misuse that static controls can miss.
👉 Read our full editorial: IAM trends are pushing NHI governance into the center