Topic starter
17/08/2026 4:42 pm
TL;DR: Akeyless says machine identities now outnumber human identities by 45x, alongside a 240% rise in digital identities in 2023 and enterprises with 10,000 employees managing nearly half a million machines. That scale makes static secrets, certificates, and tool sprawl a lifecycle governance problem, not a perimeter problem.
Editorial analysis by NHI Mgmt Group, based on content published by Akeyless: “The Rise of Machine Identities: Admiral Mike Rogers Discusses the Next Cybersecurity Frontier”.
By the numbers:
- Machine identities now outnumber human identities by 45x, according to Akeyless.
- Akeyless cited a 240% rise in digital identities in 2023.
Key questions
Q: How should security teams govern machine identities in industrial environments?
A: Security teams should govern machine identities the same way they govern privileged access: assign an owner, define a specific purpose, limit scope, and review it continuously.
Q: Why do static credentials increase risk in engineering environments?
A: Static credentials persist beyond the work they were created for, which makes them easy to copy, hardcode, share, or forget during offboarding.
Q: What breaks when identity governance is spread across too many vendor tools?
A: Lifecycle operations become inconsistent, audit trails become incomplete and deprovisioning becomes slower.
Practitioner guidance
- Map the machine identity estate Inventory service accounts, API keys, certificates, and workload credentials across cloud and on-premises environments, then assign an owner and renewal path to each one.
- Shorten the lifetime of reusable secrets Replace long-lived machine credentials with short-lived issuance wherever workloads support it, and define explicit expiry for every credential class that cannot yet be removed.
- Consolidate lifecycle control points Align secrets management, certificate lifecycle management, and privileged access workflows so that issuance, rotation, and revocation are governed together.
Bottom line: Machine identity growth is outpacing the governance models many enterprises still use, and that mismatch creates lasting exposure.
What's in the full article
Akeyless's full post covers the operational detail this post intentionally leaves for the source:
- The specific machine identity and secrets management capabilities described in the fireside chat
- A fuller explanation of Akeyless's vaultless design, dynamic secrets, and secretless authentication approach
- The leadership commentary on tool sprawl, complexity reduction, and how organisations can simplify machine identity operations
- The original discussion with Admiral Mike Rogers and Oded Hareven on cybersecurity scale and operational priorities
👉 Read Akeyless's analysis of machine identity scale and legacy cybersecurity limits →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
17/08/2026 4:47 pm
Machine identity scale has become a governance problem before it becomes a tooling problem. When enterprises reach hundreds of thousands of machines, the issue is no longer whether a vault exists, but whether the identity programme can continuously account for creation, usage, rotation, and retirement across all non-human identities. That scale changes machine identity from a point control into an operating model issue. The practitioner conclusion is simple: lifecycle discipline now matters more than isolated protection.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
- 42% of machine identities have privileged access and 61% of organisations lack identity security controls for cloud workloads, according to CyberArk's 2025 Identity Security Landscape.
A question worth separating out:
Q: What should teams do first when machine identities outnumber human accounts?
A: Start with an inventory of all machine identities, then rank them by business criticality and credential lifetime. That gives you a practical way to target the highest-risk secrets and certificates first, instead of trying to remediate the entire estate at once.
👉 Read our full editorial: Machine identity scale is exposing the limits of legacy cybersecurity