Topic starter
08/02/2026 8:23 pm
TL;DR: Non-human identities outnumber human users by 10-50x in enterprise environments and can retain persistent, MFA-free access through service accounts, OAuth tokens, API keys, and automation workflows, according to Obsidian Security. That makes NHI governance a structural IAM problem, not a narrow hygiene issue.
Editorial analysis by NHI Mgmt Group, based on content published by Obsidian Security: “What Are Non-Human Identities? NHI Security Explained”.
Key questions
Q: What breaks when non-human identities are governed like human users?
A: Lifecycle triggers, ownership, and review processes stop working because machine identities do not generate joiner, mover, or leaver events.
Q: Why do long-lived machine credentials increase breach risk?
A: Long-lived credentials create a standing access path that can survive code changes, personnel changes, and forgotten integrations.
Q: What are the signs that NHI governance is failing in an enterprise?
A: Common warning signs include unclear ownership for service accounts, secrets stored in code or configuration instead of managed vaults, infrequent rotation, and weak offboarding of API keys.
Practitioner guidance
- Inventory machine identities across SaaS and cloud Build a register of service accounts, OAuth grants, API keys, automation bots, and service principals with owners, purpose, and expiry state.
- Classify stale and overprivileged credentials Prioritise NHIs that are inactive, broadly scoped, or detached from a current business process because they create the easiest lateral movement paths.
- Enforce lifecycle revocation for inactive integrations Define offboarding for API keys and tokens so decommissioned apps, departed staff, and retired workflows do not leave valid credentials behind.
Bottom line: Non-human identities are not a niche exception in enterprise identity programmes. They are a larger and more persistent access layer that human controls routinely miss.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
08/10/2026 4:41 pm
Non-human identity governance is now an identity discipline of its own. The article makes clear that service accounts, tokens, and API keys are not edge cases but the operational fabric of modern SaaS. That means the control model cannot remain an extension of human IAM, because the subject being governed is different in lifecycle, telemetry, and revocation behaviour. The practitioner conclusion is that NHI inventory, ownership, and offboarding must stand as separate governance functions, not side tasks inside employee identity management.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should teams prioritise NHI discovery versus credential rotation?
A: Discovery comes first when the estate is unknown, because you cannot rotate what you have not found. But rotation becomes the higher priority once critical credentials are identified, because unrotated secrets preserve risk even after inventory improves. The two controls must be sequenced, not treated as alternatives.
👉 Read our full editorial: Non-human identities outnumber users and outlast human controls