Topic starter
17/08/2026 4:38 pm
TL;DR: Akeyless says machine identities now make up more than 90% of identities in many enterprises, and Gartner’s 2026 Innovation Insights finds most organisations still lack centralized governance, automation and visibility for secrets and machine IAM. The control gap is structural: static credentials, fragmented tooling and inconsistent enforcement cannot keep pace with ephemeral machine access.
Editorial analysis by NHI Mgmt Group, based on content published by Akeyless: “Why Gartner is Right About Machine IAM, and What Security Leaders Can Do About It”.
Key questions
Q: What breaks when machine IAM is managed with ad hoc scripts and separate vaults?
A: Governance breaks because no single team can prove which machine identities exist, who owns them, or whether their access is still appropriate.
Q: Why do static credentials create so much risk for machine identities?
A: Static credentials are hard to track, easy to copy, and often survive long after the workload that used them has changed.
Q: How can IAM teams tell whether access governance is actually working?
A: Look for complete discovery coverage, low revocation latency, and certification results that match actual entitlement inventories.
Practitioner guidance
- Inventory all machine identity classes Separate service accounts, workload identities, certificates, API keys and AI-agent credentials into one governed inventory so ownership and policy gaps are visible.
- Replace static secrets with short-lived credentials Prioritise workloads that can authenticate through identity providers and runtime issuance so the credential lifetime matches the task lifetime.
- Centralise machine identity policy enforcement Use a single control plane for issuance, rotation, audit logging and policy application so teams stop managing parallel exceptions across tools and clouds.
Bottom line: Machine identity growth has outpaced the governance model most organisations still use for access, secrets and certificate handling.
What's in the full article
Akeyless's full article covers the operational detail this post intentionally leaves for the source:
- Gartner-linked capability gaps across secrets management and machine IAM governance
- Examples of runtime secrets injection and secretless authentication in dynamic environments
- How certificate lifecycle automation and centralised logging are positioned for multi-cloud operations
- The vendor's view of how AI agent workflows fit into the same machine identity model
👉 Read Akeyless's analysis of machine IAM governance and identity sprawl →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
17/08/2026 4:44 pm
Machine IAM sprawl is now a governance failure, not a tooling gap: The article shows that most organisations have more machine identities than human ones, but still govern them as a side problem. That combination produces inconsistent enforcement, delayed provisioning and blind spots that no amount of local scripting can fix. The practical conclusion is that machine identity must be managed as a distinct governance domain, not as an extension of user IAM.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
- Enterprises manage far more machine secrets than human ones: 20 times as many according to Enterprise Strategy Group, and 45 times according to GitGuardian.
A question worth separating out:
Q: Should organisations treat agentic AI access differently from service account access?
A: Yes. Service accounts are usually persistent and can be managed through lifecycle controls, while agentic AI access is often ephemeral, runtime-selected, and initiated on demand. The right governance model is different because the identity behaviour is different. Treating both as the same class leads to control gaps and delayed policy decisions.
👉 Read our full editorial: Machine IAM governance is lagging behind identity sprawl