Notifications
Clear all
Topic starter
11/08/2026 3:21 pm
TL;DR: Machine identities now outnumber human identities and often outlive the reviews meant to govern them, according to Fischer Identity’s blog on machine identity governance. The real issue is not volume alone, but the assumption that identity can be managed on human timelines when workloads, tokens, and agents operate at machine speed.
NHIMG editorial — based on content published by Fischer Identity: Machine Identity at Scale: How Fischer Identity Governs Non-Human Identities Without Slowing the Business
By the numbers:
- 69% of organisations now have more machine identities than human ones.
- Only 38% have automated certificate lifecycle management in place.
- 57% of organisations lack a complete inventory of their machine identities.
Questions worth separating out
Q: How should security teams govern machine identities without relying on quarterly reviews?
A: Use event-driven lifecycle controls that create, update, renew, and retire machine identities when the workload changes.
Q: Why do machine identities create more risk than human identities in some environments?
A: Machine identities are often numerous, long-lived, and embedded in code or infrastructure.
Q: What breaks when machine identities have no clear owner?
A: When machine identities have no clear owner, offboarding, remediation, and accountability all fail together.
Practitioner guidance
- Inventory every non-human identity class Catalogue service accounts, API keys, certificates, workload identities, and AI agent credentials in one inventory with owner, purpose, scope, and expiration fields.
- Bind activation to explicit ownership Refuse to activate any machine identity unless it has a named owner or accountable team, because orphaned identities cannot be recertified or revoked reliably.
- Enforce short-lived credentials by default Set default TTLs and renewal rules so machine identities are automatically expired unless a business-approved exception extends them.
What's in the full article
Fischer Identity's full blog covers the operational detail this post intentionally leaves for the source:
- Step-by-step lifecycle governance patterns for service accounts, API keys, workload identities, and certificates.
- Operational examples of policy-driven creation, renewal, and decommission workflows for machine identities.
- The article's explanation of how continuous reconciliation fits into broader identity governance operations.
- Practical framing for mapping ownership, purpose, and expiry into an executable identity model.
👉 Read Fischer Identity's blog on machine identity governance at machine speed →
Machine identities at scale: is your IAM programme keeping up?
Explore further
11/08/2026 3:32 pm
Machine identity governance is now a lifecycle problem, not an access-review problem. The operating assumption behind quarterly review cycles is that identity state is stable long enough to be inspected and certified. That assumption fails when service accounts, tokens, and workload identities are created and retired between review intervals. Practitioners should treat lifecycle enforcement, not recertification, as the primary governance boundary.
A few things that frame the scale:
- 69% of organisations now have more machine identities than human ones, according to The Critical Gaps in Machine Identity Management report.
- 57% of organisations lack a complete inventory of their machine identities, which is why ownership and discovery remain the first governance blockers.
A question worth separating out:
Q: What should organisations do when machine identities already outnumber human identities?
A: Treat that as a governance design change, not just an inventory problem. Rebuild identity controls around lifecycle enforcement, automated renewal and revocation, and continuous drift detection so the programme matches machine speed instead of reporting on it after the fact.
👉 Read our full editorial: Machine identity governance at machine speed: the IAM gap exposed
