Topic starter
17/08/2026 4:37 pm
TL;DR: Machine credentials now outnumber human identities in modern enterprises, and SailPoint says Entro adds discovery, lineage mapping, and runtime defense across more than 1,200 credential types, according to SailPoint. The governance challenge is no longer visibility alone but proving ownership, lineage, and revocation across NHI estates before AI and automation scale the blast radius.
Editorial analysis by NHI Mgmt Group, based on content published by SailPoint: “Securing non-human identities: Lessons from SailPoint's Customer Zero approach”.
Key questions
Q: What breaks when machine credentials are discovered but not linked to business owners?
A: Discovery without ownership produces inventory, not governance.
Q: Why do service accounts and API keys increase governance risk?
A: They often exist outside interactive controls such as MFA and SSO, and many are created with standing access that is never reviewed.
Q: How do teams know if NHI governance is actually working?
A: Look for complete inventory coverage, clear ownership, enforced rotation, and reliable decommissioning.
Practitioner guidance
- Map credential-to-owner lineage Link each API key, token, and service account secret to the workload, script, or agent that uses it, then tie that back to a named owner or process.
- Inventory orphaned machine credentials Prioritise secrets that no longer map cleanly to an active application, repository, or business process because those are the most likely to survive past their useful life.
- Add risk ranking to remediation queues Separate routine secrets from high-risk credentials so the team can revoke, rotate, or escalate the most exposed items first without drowning in manual work.
Bottom line: Machine credentials now create an identity governance problem because ownership, lineage, and lifecycle state determine whether a secret is still defensible.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
17/08/2026 4:43 pm
Machine credentials create an identity governance problem, not just a secrets problem: Once API keys, tokens, and service account secrets power applications and AI agents, the control question shifts from whether a secret exists to whether its owner, lineage, and lifecycle are still defensible. Standard inventory and perimeter-style sweeps do not answer that question. The practitioner implication is that NHI governance has to operate as identity governance, not as a narrow secrets hygiene exercise.
A few things that frame the scale:
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to the Ultimate Guide to NHIs.
- 69% of organisations still authenticate machine identities with long-lived API keys, according to the 2026 State of AI Agent Identity Security Report.
A question worth separating out:
Q: What is the difference between secrets detection and NHI governance?
A: Secrets detection finds exposed credentials, while NHI governance tracks how those credentials are issued, reused, rotated, and retired. Detection answers whether a secret is visible. Governance answers whether the identity behind that secret is controlled throughout its lifecycle. Mature programmes need both because exposure without lifecycle control leaves the same risk open.
👉 Read our full editorial: SailPoint Entro changes NHI governance for machine credentials