Notifications
Clear all
Topic starter
17/08/2026 4:38 pm
TL;DR: Machine identities now account for more than 90% of identities in many enterprises, while Gartner’s 2026 Innovation Insights says most organisations still lack centralized governance, automation, and visibility for secrets and machine IAM, according to Akeyless. Static credentials, fragmented tooling, and inconsistent enforcement are now the core failure pattern, not edge cases.
NHIMG editorial — based on content published by Akeyless: machine IAM governance, secrets management, and AI agent identity
By the numbers:
- In many enterprises, machine identities already make up more than 90% of all identities accessing systems and data.
Questions worth separating out
Q: How should organisations govern identity across hybrid cloud environments?
A: Treat hybrid identity as a single policy problem, not separate cloud and on-prem tasks.
Q: Why do static secrets create more risk in modern machine IAM programmes?
A: Static secrets persist beyond the workload’s useful life, which increases the window for theft, reuse, and lateral movement.
Q: What breaks when machine IAM is split across teams and tools?
A: Visibility breaks first, then enforcement, then accountability.
Practitioner guidance
- Consolidate machine identity ownership Assign a single accountable owner for secrets, certificates, workload identity, and privileged machine access so governance does not fragment across platform teams.
- Replace static credentials with short-lived access Use ephemeral credentials and secretless authentication for workloads that can authenticate through native cloud or platform identity providers.
- Centralise policy, logging, and audit trails Enforce access scope and recordkeeping from one control plane so cloud, Kubernetes, and CI/CD identities follow the same baseline rules.
What's in the full article
Akeyless's full article covers the operational detail this post intentionally leaves for the source:
- Runtime implementation detail for dynamic secrets and secretless authentication across cloud and Kubernetes environments
- How the platform maps identity-based authentication to workload access in multi-cloud deployments
- Operational examples for logging, audit forwarding, and policy enforcement from a single control plane
- The article's own framing of how AI agent workflows fit into machine identity governance
👉 Read Akeyless's analysis of machine IAM governance and AI agent identity →
Machine IAM governance is lagging behind identity sprawl?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
17/08/2026 4:44 pm
Machine IAM is now a first-class governance domain, not a tooling subset. Once machine identities outnumber human identities, the old assumption that non-human access can be managed as an extension of human IAM stops holding. The governance problem spans secrets, workload identity, certificates, privileged access, and lifecycle control. Practitioners should treat machine IAM as its own control plane with explicit ownership and review.
A few things that frame the scale:
- 88.5% of organisations acknowledge that their non-human IAM practices lag behind or are merely on par with their human identity and access management efforts, according to The 2024 Non-Human Identity Security Report.
- Only 19.6% of security professionals express strong confidence in their organisation's ability to securely manage non-human workload identities, according to The 2024 Non-Human Identity Security Report.
A question worth separating out:
Q: How do you know if an IAM programme is actually working?
A: Look for fast, reliable conversion of business change into access change, plus a clean answer to who can access what and why. If revocation is slow, recertification is incomplete, or exceptions are persistent, the programme is operating below its governance intent. Measurement should focus on lifecycle latency and entitlement visibility.
👉 Read our full editorial: Machine IAM governance is lagging behind identity sprawl
