Topic starter
17/08/2026 4:42 pm
TL;DR: Machine identities now far outnumber human identities and often rely on shared secrets, dormant accounts, and weak lifecycle ownership that leave cloud environments exposed, according to Saviynt. The governance problem is not just scale but the assumption that machine access can be managed like human access while secrets stay static and unmonitored.
Editorial analysis by NHI Mgmt Group, based on content published by Saviynt: “The Rise of the Machines”.
By the numbers:
- Machine identities outnumber human identities by a ratio of 45 to 1.
- As high as 75% of secrets remain static in some organisations.
Key questions
Q: What breaks when machine identities are created faster than teams can govern them?
A: Lifecycle ownership breaks first.
Q: Why do static machine secrets increase cloud security risk?
A: Static secrets increase risk because they preserve trust after the original context has changed.
Q: How do security teams know if machine identity governance is working?
A: Look for fewer standing accounts, faster onboarding of automation workflows, auditable role approvals, and visible retention of access records after logout.
Practitioner guidance
- Map every machine identity to a named owner Require each service account, token, certificate, and API key to have a business or technical owner, a documented purpose, and a retirement trigger before it is approved for use.
- Inventory dormant machine identities Identify machine identities that have no recent use, no clear dependency, or no active service owner, then remove or quarantine them before they become hidden access paths.
- Reduce static secret dependence Replace shared secrets with secretless or short-lived authentication where possible, and enforce rotation where static credentials remain unavoidable.
Bottom line: Machine identity sprawl is exposing a governance gap that begins with ownership and ends with retirement, not just with credential creation.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
17/08/2026 4:47 pm
Machine identity sprawl is now a lifecycle governance problem, not an inventory problem. The article shows that creation is easy while retirement, ownership, and recertification lag behind. Once machine identities spread across cloud, SaaS, and business applications, governance breaks because the organisation no longer knows which identities still matter. Practitioners need to treat lifecycle ownership as the control plane, not a back-office admin task.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should organisations replace stored credentials with secretless authentication?
A: For high-risk workloads, yes. Secretless authentication removes the reusable secret from the system and replaces it with short-lived, request-bound identity, which reduces theft value and compliance burden. Organisations should prioritise services with frequent cloud access, sensitive data, or shared infrastructure first.
👉 Read our full editorial: Machine identity sprawl is exposing lifecycle gaps in cloud security