Notifications
Clear all
Topic starter
17/08/2026 4:39 pm
TL;DR: Identity is emerging as the control plane for cloud-native security, with Teleport arguing that ephemeral workloads, CI/CD pipelines, SSH access, and AI workloads all need short-lived, auditable identity rather than static secrets or opaque access paths. The implication is that infrastructure security now depends on governing humans and non-human identities together, not treating access as a separate layer.
NHIMG editorial — based on content published by Teleport: KubeCon Europe 2025: Why Identity is the New Backbone of Secure Infrastructure
By the numbers:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job.
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security.
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
Questions worth separating out
Q: How should security teams replace shared secrets for workloads that span multiple clouds?
A: Use federated workload identity so the workload proves who it is with a signed token or attestation instead of a shared static secret.
Q: Why do service accounts and workloads need the same authentication governance as people?
A: Because attackers do not care whether the identity is human or non-human if the access path is replayable or poorly scoped.
Q: What breaks when observability tools lack identity correlation?
A: You lose the ability to tell whether an action was legitimate, over-privileged, or suspicious even when the event itself is visible.
Practitioner guidance
- Replace embedded secrets with short-lived workload credentials Remove API keys and static tokens from CI/CD jobs, scripts, and deployment manifests.
- Map every infrastructure identity to an owner and expiry Maintain an inventory of service accounts, pipeline identities, and workload credentials with clear ownership, intended use, and revocation criteria.
- Correlate logs with identity context Ensure audit trails record both the action and the actor identity, including whether access came from a human, service account, or workload.
What's in the full article
Teleport's full blog post covers the operational detail this analysis intentionally leaves for the source:
- Concrete examples of how Teleport issues short-lived certificates for infrastructure access across SSH, Kubernetes, and databases
- The operational friction points teams hit when replacing SSH keys, API keys, and static secrets in platform workflows
- Practical examples of just-in-time access requests through Slack or CLI and how they expire automatically
- How Teleport correlates access sessions with identity for audit trails across multi-cloud environments
👉 Read Teleport's analysis of identity as the backbone of secure infrastructure →
Identity in cloud-native infrastructure: what IAM teams need to do now?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
17/08/2026 4:44 pm
Identity is now the control plane for cloud-native governance. The article reflects a broader shift in which infrastructure access can no longer be treated as an implementation detail. When workloads, pipelines, and operators all act through ephemeral infrastructure, the governance question becomes who or what can act, for how long, and with what traceability. That is an identity problem first and a platform problem second, and practitioners should organise controls accordingly.
A few things that frame the scale:
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, which means many teams still cannot verify who holds non-human access across the estate.
A question worth separating out:
Q: How do JIT access and workload identity work together in cloud environments?
A: Workload identity establishes who or what the actor is, while JIT access limits what it can do and for how long. Used together, they reduce standing privilege without forcing teams back to shared secrets or permanent permissions. The result is tighter control with less operational friction.
👉 Read our full editorial: Identity is becoming the control plane for secure infrastructure
