Notifications
Clear all
Topic starter
25/06/2026 1:30 pm
TL;DR: Machine identities often remain unmanaged across service accounts, API keys, OAuth tokens, bots, and cloud roles, creating visibility, ownership, and compliance gaps that attackers can exploit for lateral movement and exfiltration, according to SailPoint. The governance problem is no longer whether automation exists, but whether identity programmes can see and control the credentials that power it.
NHIMG editorial — based on content published by SailPoint: The hidden risk in automation, why machine identity security is essential
By the numbers:
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, with 46% confirmed and 26% suspected.
Questions worth separating out
Q: How should security teams govern machine identities in automation-heavy environments?
A: Security teams should govern machine identities through inventory, ownership, lifecycle control, and review, not by treating them as technical exceptions.
Q: Why do machine identities create more risk than human accounts in some programmes?
A: Machine identities often create more risk because they are numerous, long-lived, and poorly attributed.
Q: What do organisations get wrong about machine identity security?
A: They often assume that visibility into human users is enough to cover automation, but machine identities live in different systems and follow different lifecycle patterns.
Practitioner guidance
- Build a machine identity inventory from runtime evidence Correlate service accounts, API keys, OAuth tokens, cloud IAM roles, and bot accounts across application, cloud, and secrets platforms.
- Assign ownership to every non-human credential Require a named business or technical owner for each machine identity, with a documented use case, dependency set, and retirement trigger.
- Enforce lifecycle controls on long-lived secrets Map each service account or key to rotation, expiry, and revocation conditions.
What's in the full article
SailPoint's full blog covers the operational detail this post intentionally leaves for the source:
- A closer look at how SailPoint Machine Identity Security discovers and classifies machine accounts across environments.
- The vendor's description of centralized machine identity management workflows for service accounts, bots, and automation tools.
- The product-specific view of automated lifecycle management for provisioning, usage, and decommissioning.
- The compliance and certification capabilities SailPoint says it applies to machine identities in practice.
👉 Read SailPoint's analysis of machine identity security for automation-heavy environments →
Machine identity security in automation-heavy environments: what teams miss?
Explore further
25/06/2026 3:33 pm
Machine identity security is now an identity governance problem, not just a tooling problem. The article correctly frames unmanaged service accounts, API keys, bots, and cloud roles as hidden identity inventory rather than isolated technical assets. Once those identities sit outside ownership and lifecycle control, IAM programmes lose the ability to certify, rotate, or retire them with confidence. The practitioner conclusion is straightforward: machine identities must be governed as first-class identities, not operational leftovers.
A few things that frame the scale:
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap, according to The State of Secrets in AppSec.
A question worth separating out:
Q: How do compliance and audit teams prove machine identities are under control?
A: They need evidence that machine identities are discovered, owned, reviewed, and decommissioned on schedule. That means audit trails for provisioning, entitlement mapping, rotation events, and retirement actions, plus confirmation that orphaned or duplicated credentials are removed before the next review cycle.
👉 Read our full editorial: Machine identity security is now a governance requirement for automation
