Notifications
Clear all
Topic starter
17/08/2026 4:41 pm
TL;DR: Machine identities now outnumber humans by orders of magnitude, and the article argues that traditional permission models fail when APIs, tokens, and keys must be authenticated continuously rather than granted broad, standing access, according to Akeyless. The practical implication is that rotation, JIT access, and action-based authentication are becoming baseline governance requirements, not optional hardening.
NHIMG editorial — based on content published by Akeyless: a fireside chat on machine identity, automation, and API vulnerabilities at scale
By the numbers:
- NHIs outnumber human identities by 25x to 50x in modern enterprises.
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface.
Questions worth separating out
Q: How should security teams govern machine identities in industrial environments?
A: Security teams should govern machine identities the same way they govern privileged access: assign an owner, define a specific purpose, limit scope, and review it continuously.
Q: Why do machine identities create more risk than human identities in some environments?
A: Machine identities are often numerous, long-lived, and embedded in code or infrastructure.
Q: What breaks when API keys are not rotated and revoked on time?
A: When API keys are not rotated and revoked on time, old access continues to work even after ownership changes, vendor offboarding, or application updates.
Practitioner guidance
- Inventory machine credentials by business function Map every token, key, certificate, and service account to a named owner, system, and expiration rule so nothing remains anonymous in production.
- Move high-risk APIs to per-action authorisation Require sensitive APIs to validate each request against the specific action being attempted, not just the identity that authenticated earlier in the session.
- Automate revocation and rotation triggers Attach revocation to decommissioning, team changes, pipeline retirement, and service replacement so credentials do not persist after their purpose ends.
What's in the full article
Akeyless' full article covers the operational detail this post intentionally leaves for the source:
- Interview context and practitioner commentary from Adam Arellano on how security leaders think about machine identity at scale.
- Examples of how development workflows and CI/CD usage influence secure identity practices in real environments.
- Akeyless' broader discussion of its unified secrets and machine identity platform capabilities across secrets, certificates, and privileged access.
- The article's closing perspective on simplifying tool sprawl and consolidating identity controls.
👉 Read Akeyless' discussion on machine identity, automation, and API risk →
Machine identity scale and API access: are your controls keeping up?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
17/08/2026 4:46 pm
Machine identity governance is now a scale problem, not a niche administration problem. Once machines outnumber humans by orders of magnitude, the old assumption that every credential can be manually understood and reviewed stops holding. That changes the governance baseline for IAM teams, because service accounts, API keys, and tokens now define a larger part of the attack surface than human users do. The implication is that machine identity must be governed as a core identity estate, not as a separate ops task.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to Ultimate Guide to NHIs.
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
A question worth separating out:
Q: Which frameworks should teams use to govern machine identities and privilege?
A: Use NHI guidance for credential lifecycle, Zero Trust for runtime verification, and core IAM controls for ownership and least privilege. For elevated machine access, extend PAM-style governance so approvals, auditing, and revocation are enforced with the same rigour as human privileged accounts.
👉 Read our full editorial: Machine identity scale is forcing action-based authentication models
