Topic starter
17/08/2026 4:41 pm
TL;DR: P0 Security’s roundtable says non-human identities are growing at roughly 50 per human identity, while fragmented SaaS, cloud, and Kubernetes controls create blind spots that turn inventory into a governance problem. Least privilege, JIT access, and lifecycle management are now the real levers for NHI risk reduction.
Editorial analysis by NHI Mgmt Group, based on content published by P0 Security: “Trends in cloud security from cloud to workloads”.
By the numbers:
- For every human identity, there are 50 non-human identities, according to P0 Security.
Key questions
Q: What breaks when service accounts and workload identities are managed in separate silos?
A: Access reviews become incomplete, stale privileges persist longer, and indirect trust paths stay invisible.
Q: Why do service accounts and AI agents increase lateral movement risk?
A: Service accounts and AI agents often operate with persistent permissions across multiple systems, which makes them useful stepping stones after compromise.
Q: What are the signs that NHI lifecycle governance is failing in hybrid cloud?
A: The clearest signs are stale accounts that remain active after migrations, sync identities that still bridge multiple environments, and service accounts whose permissions no longer match their workload.
Practitioner guidance
- Map every workload identity to an owner and lifecycle state Build a single inventory that ties service accounts, API keys, cloud agents, and workload identities back to a human owner, system owner, and decommission date.
- Trace indirect access paths before tightening permissions Review cloud provider service agents, delegated roles, and chained access paths to see what actions an identity can perform indirectly.
- Replace standing privilege with task-scoped access Use JIT access for workload identities where continuous privilege is not needed, and pair it with short approval windows and bounded permissions.
Bottom line: Cloud-to-workload identity sprawl turns NHI governance into a lifecycle and delegation problem, not a simple inventory exercise.
What's in the full article
P0 Security's full article covers the operational detail this post intentionally leaves for the source:
- The roundtable discussion with cloud security practitioners on identity management trends and governance challenges
- The full explanation of transitive access abuse in Google Cloud service agents
- Panel commentary on lifecycle management, least privilege, and blast-radius reduction for service accounts and API keys
- The complete set of best-practice recommendations discussed in the video
👉 Read P0 Security's analysis of cloud-to-workload identity sprawl and NHI governance →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
17/08/2026 4:46 pm
Cloud-to-workload identity sprawl is really a lifecycle problem disguised as a visibility problem. The article shows that identities are proliferating across cloud, SaaS, and Kubernetes faster than most governance models can reconcile ownership and entitlement state. When a service account can outlive the team, system, or workload that created it, inventory alone cannot answer who should still have access. Practitioners need to treat identity lifecycle as the governing control plane, not an afterthought.
A few things that frame the scale:
- 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What should organisations do first when moving toward least privilege for NHIs?
A: They should start by discovering where non-human identities exist, who owns them, and what privileges they carry. After that, define policy for eligibility, review cadence, and revocation, then use JIT to time-box the permissions that remain necessary. Discovery comes before optimization because you cannot govern what you cannot see.
👉 Read our full editorial: Cloud-to-workload identity sprawl is reshaping NHI governance