Topic starter
14/11/2025 10:52 am
TL;DR: Extending zero trust and MFA-like controls to non-human identities can reduce lateral movement and secret exposure, but static credentials, policy drift, and limited workload visibility still undermine governance, according to Aembit. The real issue is not whether workloads need stronger access control, but whether IAM models can verify, govern, and revoke machine access continuously.
Editorial analysis by NHI Mgmt Group, based on content published by Aembit: “Use Case”.
Key questions
Q: What breaks when zero trust is applied to workloads that still use static secrets?
A: Zero trust breaks down when the credential itself becomes the trust token.
Q: Why do standing workload credentials increase lateral movement risk?
A: Standing credentials increase risk because they let one valid access path keep working across multiple internal services without a new authentication step.
Q: What are the signs that workload identity management is failing in a large environment?
A: Common warning signs include dormant identities that have not been reviewed for months, permissions that far exceed workload requirements, and no reliable visibility into which accounts are active.
Practitioner guidance
- Harden workload secret lifecycle controls Inventory every service account, API key, token, and certificate used by workloads, then define rotation and revocation ownership for each one.
- Move workload access decisions to runtime policy Require identity plus context checks before issuance, including the workload's environment, time of request, and policy state.
- Map workload-to-workload access paths Document which workloads can call which services, which credentials they use, and which team can revoke each path.
Bottom line: The core risk is not that workloads cannot be governed, but that static credentials and policy drift keep old trust alive after the approval moment has passed.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/10/2026 9:29 pm
Zero trust for workloads only works when trust is re-evaluated at issuance time, not inherited from the credential itself. The article's central tension is that non-human identities can be given MFA-like treatment, but static credentials still behave like standing trust. That means the real control boundary shifts from authentication events to credential lifecycle and runtime policy enforcement. Practitioners should treat workload access as continuously re-authorised access, not as a one-time grant.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
- 82% of detections were malware-free, with attackers using valid credentials and trusted tools, according to CrowdStrike's 2026 Global Threat Report.
A question worth separating out:
Q: How should teams balance zero trust and workload identity controls?
A: Teams should use zero trust as the policy model and workload identity as the execution layer. That means every non-human access request should be evaluated against identity and context, while the credential itself remains short-lived, traceable, and revocable. Human-era MFA patterns are not enough on their own.
👉 Read our full editorial: Zero trust for non-human workloads still leaves NHI gaps