Topic starter
16/01/2026 4:29 pm
TL;DR: Machine identities now outnumber humans in many cloud environments, with more than 70% of cloud privileges assigned to non-human entities, according to SafePaaS and cited CSA/EM360Tech research. That turns service accounts, bots, APIs, and certificates into a governance problem, not just an operations problem, because legacy IAM still assumes people are the primary access subject.
Editorial analysis by NHI Mgmt Group, based on content published by SafePaaS: “Machine Identities Are the New Insider Threat—Here’s How to Govern Them”.
By the numbers:
- More than 70% of cloud privileges are assigned to non-human entities such as service accounts, bots, and APIs, according to SafePaaS citing Cloud Security Alliance and EM360Tech research.
- Machine identities outnumber humans by tens of thousands to one in some cloud environments, according to SafePaaS citing Cloud Security Alliance and EM360Tech research.
- The 2025 CyberArk State of Machine Identity Security Report found that machine identities outnumber human users in most enterprises and 77% represent potential compromise points, according to SafePaaS.
Key questions
Q: What breaks when machine identities are not included in governance reviews?
A: Human-style reviews miss the identities that actually run automation, so orphaned service accounts, overprivileged APIs, and stale certificates remain active outside ownership and expiry controls.
Q: Why do machine identities create more risk than human identities in some environments?
A: Machine identities are often numerous, long-lived, and embedded in code or infrastructure.
Q: What are the signs that service account governance is failing in an organisation?
A: Common warning signs include accounts with no clear owner, broad permissions that exceed job need, credentials stored in insecure places such as code or configuration, and service accounts that survive staff departures without reassignment.
Practitioner guidance
- Map every machine identity to an owner and purpose Build a complete inventory of service accounts, bots, APIs, containers, and certificates, then assign business ownership and expiration criteria so no non-human identity exists without accountability.
- Tie access reviews to machine identity lifecycle Include non-human identities in certification and recertification cycles, and require review of who owns the credential, what it can access, and whether the workload still needs it.
- Reduce standing privilege for automated actors Re-scope machine credentials to the minimum function they actually perform, especially where bots and integrations have accumulated permissions across multiple environments.
Bottom line: Machine identities are now operating as insiders in enterprise systems, which makes them a governance problem rather than an operations footnote.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
06/10/2026 3:40 pm
Machine identity governance is now insider-risk governance: when service accounts, bots, APIs, and certificates hold the majority of cloud privilege, the distinction between user governance and machine governance stops being useful. The governance question shifts from who logged in to what credentialed actor can already act inside the environment. Practitioners should treat machine identity as a first-class access subject, not a by-product of application delivery.
A few things that frame the scale:
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should organisations treat machine identities differently from human accounts?
A: Yes, because the governance model is different even when the control objective is the same. Human accounts follow employment and authentication patterns; machine identities follow workload, integration, and secret-lifecycle patterns. Treating them identically leads to missed ownership, poor expiry discipline, and privilege that survives long after the business need has changed.
👉 Read our full editorial: Machine identities are the new insiders in enterprise governance