Notifications
Clear all
Topic starter
17/08/2026 4:41 pm
TL;DR: NHIs are growing far faster than human identities, with panelists in P0 Security’s roundtable citing a 50-to-1 ratio and warning that fragmented cloud, SaaS, and Kubernetes identity systems create blind spots for access governance. The practical issue is no longer inventory alone; lifecycle control, least privilege, and blast-radius reduction now define workable NHI security.
NHIMG editorial — based on content published by P0 Security: Trends in cloud security from cloud to workloads
By the numbers:
- For every human identity, there are 50 non-human identities.
- NHIs outnumber human identities by 25x to 50x in modern enterprises.
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
Questions worth separating out
Q: What breaks when service accounts and workload identities are managed in separate silos?
A: Access reviews become incomplete, stale privileges persist longer, and indirect trust paths stay invisible.
Q: Why do non-human identities increase cloud IAM risk so quickly?
A: Non-human identities increase cloud IAM risk because they multiply faster than human accounts and often carry persistent access with weak ownership.
Q: What do security teams get wrong about least privilege in SaaS and cloud environments?
A: Teams often treat least privilege as a role design exercise when the real problem is entitlement drift across multiple identities.
Practitioner guidance
- Inventory all identities across clouds and workloads Create a single register for service accounts, API keys, workload identities, and human administrators across cloud, SaaS, and Kubernetes environments.
- Trace transitive trust paths Map which background agents, provider-managed identities, and delegated roles can reach sensitive data or control planes indirectly.
- Replace standing privilege with task-scoped access Use just-in-time elevation for high-risk cloud actions and limit entitlements to the narrowest operational window.
What's in the full article
P0 Security's full post covers the operational detail this post intentionally leaves for the source:
- Direct video timestamps for the panel's discussion of transitive access abuse and workload identity risk
- Speaker-by-speaker commentary on identity fragmentation, lifecycle management, and least-privilege controls
- Panel examples covering permission boundaries, blast-radius reduction, and programmatic remediation
- The full roundtable video for practitioners who want the discussion context and examples in sequence
👉 Read P0 Security’s analysis of cloud-to-workload identity trends and NHI risk →
Cloud-to-workload identity sprawl: what IAM teams need now?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
17/08/2026 4:46 pm
Cloud-to-workload identity governance is now an NHI problem, not a niche cloud problem. Once service accounts, APIs, and background agents cross cloud, SaaS, and Kubernetes boundaries, the control model has to follow the identity rather than the platform. That means visibility, lifecycle, and privilege decisions must be unified across environments, not delegated to separate tools. Practitioners should treat this as a programme design issue, not a point-solution gap.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, which helps explain why fragmented cloud identity governance persists.
A question worth separating out:
Q: How can organisations limit the blast radius of a compromised workload?
A: Organisations can limit blast radius by scoping each workload to the minimum resources, shortest credential lifetime, and narrowest execution context required. They should also remove reusable credentials, enforce environment-aware policy, and review cross-system trust paths. The objective is to prevent one compromised workload from becoming a platform-wide access event.
👉 Read our full editorial: Cloud-to-workload identity sprawl is reshaping NHI governance
