Notifications
Clear all
Topic starter
17/08/2026 4:42 pm
TL;DR: Machine identities now outnumber human identities by 45 to 1, and Saviynt argues that static secrets, dormant accounts, and poor lifecycle ownership are leaving cloud environments exposed as AI agents and interconnected systems expand the attack surface. The core issue is that identity governance still treats machine access as an afterthought while privilege and secret sprawl accelerate.
NHIMG editorial — based on content published by Saviynt: The Rise of the Machines
By the numbers:
- Anecdotal evidence shows that in some organizations, as high as 75% of secrets remain static, significantly increasing the risk of exploitation.
- Cloudflare rotated over 5,000 secrets after the Okta support incident, but four were still missed.
Questions worth separating out
Q: What breaks when corporate IT machine identities are not lifecycle-managed?
A: What breaks is the assumption that mature infrastructure controls automatically govern non-human access.
Q: Why do machine identities increase lateral movement risk in cloud and SaaS environments?
A: Machine identities often have persistent access, broad integration reach and fewer human friction points than user accounts.
Q: How do security teams know if machine identity governance is actually working?
A: It is working when the team can identify every machine identity, name the owner, map the dependency, and show recent rotation or retirement actions.
Practitioner guidance
- Inventory machine identities by owner and purpose Build a current register of service accounts, API keys, tokens, and certificates, and require each one to have a named owner, a valid purpose, and a retirement date.
- Replace shared secrets where workloads permit it Reduce dependence on reusable credentials by moving toward secretless or strongly scoped authentication for workloads that can support it.
- Rotate and revoke through lifecycle events Tie rotation and revocation to deployment changes, vendor offboarding, application retirement, and incident response rather than calendar-only cycles.
What's in the full article
Saviynt's full blog covers the operational detail this post intentionally leaves for the source:
- Examples of where machine identities are being created by developers, business users, and automation workflows.
- Specific guidance on when to prefer secretless authentication versus managed secrets for workloads.
- The article's recommended hygiene steps for finding dormant machine identities across cloud, SaaS, and business applications.
- Why the vendor frames secret vaulting and secret rotation as part of PAM rather than a standalone fix.
👉 Read Saviynt's analysis of machine identity growth and secret management →
Machine identity sprawl: what IAM teams need to fix first?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
17/08/2026 4:47 pm
Machine identity sprawl is the result of governance lag, not just cloud growth. The article correctly shows that machine identities are multiplying faster than most organisations can assign ownership, monitor usage, and retire stale access. Once a credential can be created by developers, business users, or automated pipelines, lifecycle discipline becomes the real control plane. Practitioners should read this as a machine identity governance problem, not a tooling problem.
A few things that frame the scale:
- Only 19.6% of security professionals express strong confidence in their organisation's ability to securely manage non-human workload identities, according to the 2024 Non-Human Identity Security Report.
- 88.5% of organisations acknowledge that their non-human IAM practices lag behind or are merely on par with their human identity and access management efforts.
A question worth separating out:
Q: How do organisations decide between secretless authentication and rotation?
A: Use secretless authentication wherever the platform and integration allow it, because it removes manual secret handling from the workflow. Where legacy systems block that option, rotation becomes the compensating control, supported by least privilege and monitoring. The decision is not either-or across the estate; it is capability-based by integration.
👉 Read our full editorial: Machine identity sprawl is exposing lifecycle gaps in cloud security
