Notifications
Clear all
Topic starter
01/07/2026 2:02 am
TL;DR: Machine identities now outnumber human users in 69% of organisations, while 66% say current tooling cannot manage the scale and 61% still rely on spreadsheets or manual tracking, according to SailPoint's The Critical Gaps in Machine Identity Management report. The governance problem is no longer coverage, but ownership, lifecycle control, and auditability at machine speed.
NHIMG editorial — based on content published by SecurEnds: machine identity governance and the controls enterprises need
By the numbers:
- 69% of organisations now have more machine identities than human ones.
- 66% say their current tooling is not adequate to manage the scale of machine identities they now have.
- 61% rely on spreadsheets or manual tracking for machine identity management.
Questions worth separating out
Q: How should security teams govern machine identities across cloud and DevOps environments?
A: Security teams should treat machine identities as governed assets, not deployment by-products.
Q: Why do machine identities create more governance risk than human accounts in many environments?
A: Machine identities often scale faster than human users, are created automatically, and are frequently left with standing permissions after the original use case changes.
Q: What breaks when machine identity ownership is unclear?
A: When ownership is unclear, recertification becomes a checkbox exercise, rotation accountability weakens, and dormant credentials stay active.
Practitioner guidance
- Build a live inventory of machine identities Track service accounts, API keys, certificates, tokens, workload identities, and automation accounts in one control view, then reconcile that inventory against cloud, CI/CD, and application sources on a continuous basis.
- Assign accountable business and technical owners Require each machine identity to map to both a business owner who can justify the access and a technical owner who can confirm the workload dependency and support lifecycle decisions.
- Review high-risk machine permissions on a fixed cadence Prioritise privileged service accounts, exposed API credentials, and production workload identities for recurring recertification so dormant access and privilege creep are removed before audit time.
What's in the full article
SecurEnds's full article covers the operational detail this post intentionally leaves for the source:
- Step-by-step guidance on centralising discovery for service accounts, certificates, workload identities, and API credentials
- The article's practical checklist for ownership assignment, access review, and governance workflow design
- Detailed examples of machine identity metrics used to evidence auditability and control maturity
- SecurEnds's description of how its platform supports review workflows and compliance reporting
👉 Read SecurEnds's analysis of machine identity governance and control gaps →
Machine identity governance: what IAM teams are missing now?
Explore further
01/07/2026 2:21 am
Machine identity governance has moved from hygiene to core control plane. When machine identities outnumber humans, the problem is no longer whether the enterprise has a policy, but whether that policy can keep pace with machine creation, delegation, and expiry. Governance for service accounts, keys, and certificates must operate as a live control plane, not a periodic review exercise. The implication is that identity teams now have to manage machine population drift as a standing risk, not an edge case.
A few things that frame the scale:
- 53% of organisations have experienced a security incident directly related to machine identity management failures, according to The Critical Gaps in Machine Identity Management report.
- 59% of companies face greater difficulties auditing machine identities, primarily due to lack of clear ownership and limited visibility.
A question worth separating out:
Q: Who should be accountable for machine identity lifecycle governance?
A: Accountability should sit with both the business service owner and the technical platform owner, because machine identities span application need and operational dependency. Human IAM teams, IGA teams, and platform teams each own part of the lifecycle, but none can govern it alone. Clear accountability is what makes review, offboarding, and rotation actually enforceable.
👉 Read our full editorial: Machine identity governance is now the IAM control gap
