Notifications
Clear all
Topic starter
17/08/2026 4:37 pm
TL;DR: Machine credentials now outnumber human identities in modern enterprises, and SailPoint says Entro adds discovery, lineage mapping, and runtime defense across more than 1,200 credential types, according to SailPoint. The governance challenge is no longer visibility alone but proving ownership, lineage, and revocation across NHI estates before AI and automation scale the blast radius.
NHIMG editorial — based on content published by SailPoint: Securing non-human identities and lessons from the Customer Zero approach
By the numbers:
- SailPoint says Entro adds discovery for over 1,200 credential types.
Questions worth separating out
Q: How should security teams govern machine credentials across cloud and CI/CD environments?
A: Security teams should treat machine credentials as production identities with owners, scopes, and lifecycles.
Q: Why do non-human identities become a bigger risk in AI-speed attacks?
A: Because NHIs often provide the shortest route from discovery to real access.
Q: What breaks when machine credentials are discovered but not linked to business owners?
A: Discovery without ownership produces inventory, not governance.
Practitioner guidance
- Map every machine credential to an owner and dependency Create a live inventory that ties each API key, token, certificate, and service account to the application or workflow that uses it, plus the business owner responsible for revocation decisions.
- Add lineage checks to revocation workflows Do not retire credentials until you know which scripts, agents, and integrations depend on them, then document the fallback path for each dependency before decommissioning.
- Combine secret discovery with runtime monitoring Track not only where secrets are stored but also how they behave in production, including unusual token use, new tool calls, and access to unexpected services.
What's in the full article
SailPoint's full blog covers the operational detail this post intentionally leaves for the source:
- Internal Customer Zero validation results from SailPoint's own environment and developer repositories
- How Entro categorises findings into one-touch remediation versus AI-guided remediation
- The internal correlation method used to link credentials back to people, applications, and business processes
- What the unified identity graph is used to show auditors and cyber insurers during governance reviews
👉 Read SailPoint’s analysis of securing non-human identities with Entro →
Machine credentials and AI agents: what changes for governance teams?
Explore further
17/08/2026 4:43 pm
Machine credentials have become a governance class, not a tooling edge case. When API keys, tokens, and service accounts outnumber human identities, the identity programme must treat them as first-order assets with lifecycle, ownership, and review requirements. Traditional IAM that stops at human authentication cannot explain runtime behaviour or revoke what it cannot fully inventory. The practitioner conclusion is that NHI governance now sits inside the core identity operating model.
A few things that frame the scale:
- 28.65 million new hardcoded secrets were detected in public GitHub commits in 2025 alone, a 34% year-over-year increase and the largest single-year jump ever recorded, according to the State of Secrets Sprawl 2026.
- 64% of valid secrets leaked in 2022 are still valid and exploitable today, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: Should organisations treat agentic AI access differently from service account access?
A: Yes. Service accounts are usually persistent and can be managed through lifecycle controls, while agentic AI access is often ephemeral, runtime-selected, and initiated on demand. The right governance model is different because the identity behaviour is different. Treating both as the same class leads to control gaps and delayed policy decisions.
👉 Read our full editorial: SailPoint Entro changes NHI governance for machine credentials
