Topic starter
07/03/2026 1:31 am
TL;DR: Machine identities now outnumber human identities by more than 100:1 in many enterprises, with some sectors approaching 500:1, and 50% of organizations report breaches tied to compromised machine identities, according to Obsidian Security. The governance problem is structural: inventory alone cannot control credentials that are created fast, reused widely, and rarely owned.
Editorial analysis by NHI Mgmt Group, based on content published by Obsidian Security: “What Are Machine Identities? Security Risks & Management Guide”.
By the numbers:
- Machine identities now outnumber human identities by ratios exceeding 100:1 in enterprise environments, with some sectors approaching 500:1.
- 50% of organisations experienced security breaches tied to compromised machine identities within the past year.
- Only 12% of organisations have achieved comprehensive automated lifecycle management for machine identities, leaving 88% dependent on manual tracking and ad-hoc processes.
Key questions
Q: What breaks when machine identities are tracked manually?
A: Manual tracking breaks when credential volume outpaces human oversight.
Q: Why do compromised machine identities create such a high security risk for modern enterprises?
A: Compromised machine identities matter because they can impersonate trusted devices or services and move through systems with the same legitimacy as the original workload.
Q: What are the signs that machine identity controls are failing in a cloud environment?
A: Machine identity controls are likely failing when teams find unexplained API access, stale secrets that remain valid for long periods, or accounts that were never challenged with MFA.
Practitioner guidance
- Map every machine identity to an owner Assign a named business or platform owner for each API key, certificate, service account, and token so lifecycle decisions have accountability.
- Inventory machine credentials continuously Discover credentials across SaaS, cloud, CI/CD, and endpoint stores, then reconcile them against expected systems and approved use cases.
- Automate expiration and rotation workflows Replace manual renewal tracking with enforced expiry, renewal alerts, and revocation paths for certificates, tokens, and keys.
Bottom line: Machine identities create governance gaps because they are created and used at machine speed, not human speed, so traditional IAM review cycles miss the risk.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
08/10/2026 4:34 pm
Machine identity risk is now an ownership problem before it is a technology problem: the central failure is that credentials exist without a clearly governed owner, so no one is accountable for rotation, scope review, or retirement. That breaks the basic IAM assumption that access can be tied back to a person, team, or lifecycle event. Practitioners need to treat ownership as the control that determines whether any later governance is even possible.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How do organisations balance availability and security for machine credentials?
A: The two goals are the same problem when certificates, tokens, or service accounts gate production access. Organisations need lifecycle controls that prevent expiry surprises while also tightening scope, because a credential that stays live too long can be both reliable and overexposed.
👉 Read our full editorial: Machine identities are outpacing IAM controls and creating hidden risk