Topic starter
09/09/2025 6:32 pm
TL;DR: Unosecur finds that non-human identities now underpin cloud microservices, serverless functions, bots and CI/CD workflows, yet they are still misconfigured, over-privileged and often left out of audit routines. Governance fails when service accounts and automation are treated as secondary identities rather than first-class access subjects.
Editorial analysis by NHI Mgmt Group, based on content published by Unosecur: “Non-human identity”.
Key questions
Q: What breaks when non-human identities are not included in least privilege reviews?
A: When non-human identities are left out of least privilege reviews, access tends to accumulate quietly across service accounts, API keys, tokens, and automation workflows.
Q: Why do over-privileged service accounts increase production breach impact?
A: Because production service accounts often sit inside the trust fabric of the live environment, excessive permissions let one compromised identity reach many systems.
Q: How do organisations know whether non-human identity governance is working?
A: Look for three signals: fewer standing credentials, faster revocation of secrets and tokens, and evidence that access decisions match the actual runtime behaviour of the identity.
Practitioner guidance
- Inventory every non-human identity Create a complete register of service accounts, API keys, bots, tokens and certificates, then assign an owner, purpose and business system to each one.
- Reduce standing privilege on automation accounts Review cloud and CI/CD permissions so each identity can only reach the resources needed for its current task, deployment path or data flow.
- Rotate and retire credentials on a defined schedule Set short rotation intervals for long-lived secrets and revoke credentials immediately when the workload is replaced, paused or no longer owned.
Bottom line: The core problem is not simply that non-human identities exist, but that cloud teams still govern many of them as secondary objects rather than as first-class access subjects.
What's in the full article
Unosecur's full article covers the operational detail this post intentionally leaves for the source:
- Examples of non-human identities used in CI/CD pipelines, microservices and data ingestion tasks
- The article's explanation of how service accounts become hidden backdoors when credentials are not rotated
- The Atlassian automation bot case study and why exposed internal API keys create high-value targets
- Practical governance actions for restricting scope and monitoring usage across automated identities
👉 Read Unosecur's analysis of why non-human identity governance is lagging cloud reality →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 5 days ago by NHI Mgmt Group
07/10/2026 6:22 pm
Non-human identity governance is now a cloud operating requirement, not a niche control problem. Cloud architecture has made service accounts, API keys and automation bots core execution subjects, yet many governance programmes still treat them as subordinate to human access. That mismatch is why the same identities that keep workloads running also become hidden paths into production systems. The implication is that identity governance must be modelled around workload reality, not employee-centred assumptions.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
- 59% of compromised machines in a major 2025 supply chain attack were CI/CD runners rather than personal workstations, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: Should organisations prioritise rotation or privilege reduction for non-human identities?
A: They should do both, but privilege reduction usually changes the blast radius faster. Rotation limits how long a stolen secret can be reused, while least privilege limits what that identity can do if it is compromised. Where automation is widespread, teams should first remove unnecessary access, then tighten rotation and revocation timing.
👉 Read our full editorial: Non-human identity governance is still lagging cloud reality