Topic starter
09/07/2026 3:30 pm
TL;DR: Machine identities now outnumber human identities in many environments, and Commvault argues that governance, visibility, and auditability have not kept pace with how applications, services, APIs, and automated workloads actually operate. The result is persistent privilege sprawl, weak accountability, and a security model that still assumes human-paced lifecycle controls are enough.
Editorial analysis by NHI Mgmt Group, based on content published by Commvault: “Machine Identities and the Governance Gap”.
Key questions
Q: What breaks when organisations manage machine identities like user accounts?
A: The programme loses visibility, ownership, and lifecycle control.
Q: Why do third-party credentials increase lateral movement risk?
A: Third-party credentials increase lateral movement risk because they often bridge into multiple systems, clients, or cloud services with more privilege than a normal user account.
Q: How do security teams know whether machine identity governance is working?
A: They know it is working when every non-human credential has a named owner, a visible system scope, and a documented retirement path.
Practitioner guidance
- Inventory every machine identity Build a complete register of applications, services, APIs, and automated workloads that authenticate without human interaction, then record where each identity is created and why it exists.
- Map each credential to a human owner Assign an accountable human owner to every non-human identity so review, remediation, and incident response have a clear decision-maker.
- Review standing access on machine identities Identify service accounts and tokens that retain permissions beyond the business task they support, especially where those permissions cross system boundaries.
Bottom line: Machine identities have outgrown human-centric governance, and that mismatch leaves organisations unable to explain who owns access or why it still exists.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
09/07/2026 3:51 pm
Human-era identity governance is no longer the default control model for modern environments. Machine identities are now part of the primary operating fabric, not a side category of technical accounts. That changes the governance problem from user access administration to accountability across applications, services, APIs, and automated workloads. The practitioner conclusion is that identity programmes must govern the entity that actually executes work, not just the person who requested it.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Who should be accountable for machine identity lifecycle management?
A: Accountability should sit with the platform or application owner who benefits from the identity, supported by IAM, security, and operations teams. If nobody owns rotation, offboarding, and review, the credential will outlive the system it was meant to support. Lifecycle control is only real when revocation is assigned and tested.
👉 Read our full editorial: Machine identity governance is lagging behind operational reality