Notifications
Clear all
Topic starter
17/08/2026 4:42 pm
TL;DR: Machine identities now outnumber human identities by 45x, and Akeyless says static machine identities, secrets, and certificates are becoming harder to govern as tool sprawl accelerates. That combination makes lifecycle control, not just perimeter defense, the central identity security problem for modern enterprises.
NHIMG editorial — based on content published by Akeyless: a fireside chat on machine identity scale and cybersecurity complexity
By the numbers:
- Machine identities outnumber human identities by 45x, according to the conversation published by Akeyless.
- The article describes a 240% rise in digital identities in 2023, showing how fast the governance surface is expanding.
- A reported 5,000-plus cybersecurity vendors underscores how tool proliferation can complicate control consistency.
Questions worth separating out
Q: How should security teams govern machine identities in industrial environments?
A: Security teams should govern machine identities the same way they govern privileged access: assign an owner, define a specific purpose, limit scope, and review it continuously.
Q: Why do static secrets create more risk in modern machine IAM programmes?
A: Static secrets persist beyond the workload’s useful life, which increases the window for theft, reuse, and lateral movement.
Q: What breaks when machine identity lifecycle management is still partly manual?
A: Manual lifecycle management breaks first at scale.
Practitioner guidance
- Map machine identity ownership end to end Assign a business or platform owner to each machine identity, including service accounts, certificates, and workload credentials, then document who can issue, rotate, and revoke them.
- Replace long-lived secrets where workloads allow it Move services toward secretless authentication patterns such as OIDC, SPIFFE, or SPIRE when the workload and platform support runtime identity.
- Automate rotation and revocation workflows Build lifecycle automation for credential issuance, renewal, and offboarding so machine identities do not depend on periodic manual cleanup.
What's in the full article
Akeyless's full post covers the operational detail this post intentionally leaves for the source:
- The full conversation on how Akeyless frames vaultless secrets management and certificate lifecycle control in practice
- The specific operational trade-offs behind dynamic secrets, secretless authentication, and secure remote access
- The leadership guidance Admiral Mike Rogers gives on simplifying cybersecurity operations at scale
- The vendor's detailed explanation of how DFC-based architecture is positioned across machine identity use cases
👉 Read Akeyless's fireside chat on machine identity scale and cybersecurity complexity →
Machine identity scale and the governance gap teams are missing?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
17/08/2026 4:47 pm
Machine identity sprawl has become a governance problem, not just a security problem. The article is right to connect identity growth with operational complexity, because machine identities are now abundant enough to overwhelm manual control models. Once the population expands faster than review and revocation processes, governance becomes the limiting factor. Practitioners need to treat machine identity scale as a lifecycle discipline, not a point solution problem.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
- Only 20% have formal processes for offboarding and revoking API keys, which shows how often lifecycle control lags identity growth.
A question worth separating out:
Q: Who should own machine identity change control in an IAM programme?
A: Identity and platform teams should share ownership, with security defining policy and operations managing the implementation. Machine identities behave like production infrastructure, so access rules, bot registrations, and signature checks need the same review discipline as application changes. That makes change control part of identity governance, not a separate engineering activity.
👉 Read our full editorial: Machine identity scale is exposing the limits of legacy cybersecurity
