Notifications
Clear all
Topic starter
07/09/2026 6:25 pm
TL;DR: Credential-related breaches are now the leading cause of cybersecurity incidents in financial services, and Akeyless argues that machine identities, not human users, drive most of the exposure. The central problem is not secrets storage alone but standing access, slow rotation, and governance models that cannot keep pace with DevOps scale.
NHIMG editorial — based on content published by Akeyless: A DevOps-First Guide to Securing Machine Identities in a High-Risk, Regulated World
By the numbers:
- According to the IBM Cost of a Data Breach Report (2024), the average cost of a breach in financial services is over $6 million.
- For every human user in the environment, there are at least 45 machine identities.
- 85% of identity-related breaches are tied to machine, chine identities.
Questions worth separating out
Q: What breaks when organisations keep using standing privileges for machine identities?
A: Standing privilege turns NHIs into persistent trust anchors.
Q: Why do financial services need to prioritise machine identity governance?
A: Financial environments depend on large numbers of non-human credentials to move data and execute transactions at machine speed.
Q: How do security teams know whether secret rotation is actually working?
A: Rotation is working only if exposed credentials are found quickly, revoked everywhere they are used and replaced before attackers can reuse them.
Practitioner guidance
- Centralise machine credential inventory Build a single inventory for API keys, certificates, tokens, and service accounts across code, CI/CD, cloud, and collaboration tools.
- Replace persistent access with JIT issuance Use temporary, policy-bound secrets for privileged machine tasks and expire them automatically after completion.
- Automate revocation across downstream systems Trigger secret invalidation the moment a leak, misuse, or role change is detected, then propagate updates to databases, containers, APIs, and pipeline variables without manual intervention.
What's in the full article
Akeyless's full article covers the operational detail this post intentionally leaves for the source:
- Step-by-step secrets management patterns for DevOps and financial services pipelines
- Detailed compliance mapping for PCI DSS v4.0, GLBA, NYDFS, SOX, and SEC expectations
- Implementation notes for DFC, zero-knowledge architecture, and hybrid deployment models
- Product-specific integration guidance for GitHub Actions, GitLab, Jenkins, Terraform, IAM roles, and OIDC
👉 Read Akeyless's analysis of machine identity security in financial DevOps →
Machine identities in DevOps: what financial teams need now?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
07/09/2026 6:25 pm
Machine identity governance is now a core financial control plane, not a tooling choice. When machine identities outnumber humans by a wide margin, the real governance question is who owns issuance, rotation, revocation, and audit across the full lifecycle. Secrets management tools matter, but they do not replace lifecycle governance. The implication is that IAM, PAM, and DevOps teams must treat machine identity as a formal programme domain, not an engineering convenience.
A few things that frame the scale:
- 64% of valid secrets leaked in 2022 are still valid and exploitable today, according to the Ultimate Guide to NHIs.
- Only 20% have formal processes for offboarding and revoking API keys, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What should teams do when secrets are embedded in DevOps pipelines?
A: Treat embedded secrets as a lifecycle defect, not a storage issue. Remove hardcoded credentials, replace them with short-lived issuance paths, and ensure the pipeline can revoke access automatically when a leak or change occurs. The goal is to make the pipeline consume identity, not store it.
👉 Read our full editorial: Securing machine identities in financial DevOps environments
