Notifications
Clear all
Topic starter
17/08/2026 4:37 pm
TL;DR: Machine identities now outnumber human accounts by 25x to 50x in modern enterprises, and Akeyless argues that unmanaged secrets, weak lifecycle controls, and over-permissioned service accounts create an expanding attack surface for cloud and AI workloads. The governance gap is structural: access, rotation, revocation, and audit models built for people do not scale cleanly to NHIs or autonomous systems.
NHIMG editorial — based on content published by Akeyless: Machine identity management and the silent threat of non-human identities
By the numbers:
- NHIs outnumber human identities by 25x to 50x in modern enterprises.
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface.
Questions worth separating out
Q: How should security teams govern machine identities differently from human users?
A: Security teams should govern machine identities with lifecycle, context, and runtime controls, not human approval workflows.
Q: Why do NHIs create a different risk profile from human users?
A: NHIs often operate at scale, run continuously, and depend on secrets that are easy to copy, embed, or forget.
Q: What breaks when secrets are stored in code and CI/CD tools?
A: Access becomes invisible, reusable, and hard to revoke, which means the organisation loses control of where authentication material exists.
Practitioner guidance
- Inventory all machine identities and their secret locations Map API keys, tokens, certificates, service accounts, and embedded secrets across code, CI/CD, containers, and cloud services.
- Move high-risk NHIs to just-in-time access Replace always-on permissions with short-lived credentials for workloads that only need access during a defined task window.
- Automate rotation and revocation across the full lifecycle Tie issuance, renewal, and shutdown to automated workflows, and verify that applications can tolerate rotated secrets without downtime.
What's in the full article
Akeyless's full article covers the operational detail this post intentionally leaves for the source:
- Step-by-step lifecycle examples for issuing, provisioning, rotating, and revoking machine identities in cloud environments
- Implementation guidance for embedding secrets into CI/CD pipelines without hardcoding or manual distribution
- Operational patterns for secretless authentication and runtime validation in ephemeral workloads
- Context on how Akeyless positions machine identity management alongside emerging agentic AI workloads
👉 Read Akeyless's analysis of machine identity management and NHI lifecycle controls →
Machine identity management and NHI sprawl: are controls keeping up?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
17/08/2026 4:44 pm
Machine identity governance is now the baseline for modern IAM, not a specialist side track. The article correctly treats NHIs as first-class identities because they now outnumber human accounts and drive essential business workflows. That changes the governance burden for IAM, IGA, PAM, and cloud security teams alike. If machine credentials are not governed with the same lifecycle discipline as human access, identity programmes are incomplete by design.
A few things that frame the scale:
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to Ultimate Guide to NHIs , Lifecycle Processes for Managing NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, which means most teams still cannot see the full machine identity estate they are responsible for.
A question worth separating out:
Q: How do organisations reduce the impact of stolen API credentials?
A: Organisations reduce impact by shortening credential lifetime, removing credential reuse, and limiting each API identity to the smallest possible scope. They should also monitor for unusual usage patterns that suggest impersonation or automation abuse. If a credential is stolen, the organisation should be able to revoke it quickly without breaking unrelated services.
👉 Read our full editorial: Machine identity management is now central to NHI security
