Topic starter
16/01/2026 12:36 pm
TL;DR: Machine identities now outnumber humans by roughly 45 to 1 in many enterprises, while 28.65 million new hardcoded secrets were detected in public GitHub commits in 2025, according to GitGuardian and Token Security’s analysis of machine identity governance. The governance gap is no longer theoretical: discovery, ownership, rotation, and access review must move from manual review to policy-driven control.
Editorial analysis by NHI Mgmt Group, based on content published by Token Security: “Machine Identity Governance: Best Practices for Non-Human Entities”.
Key questions
Q: What breaks when machine identities have no clear owner?
A: When machine identities have no clear owner, offboarding, remediation, and accountability all fail together.
Q: Why do overprivileged service accounts create such persistent cloud risk?
A: Overprivileged service accounts create persistent risk because they combine standing access, weak ownership, and broad lateral movement potential.
Q: How do security teams know if NHI controls are actually working?
A: Look for complete inventory coverage, clear ownership, enforced rotation, and evidence that unused credentials are removed on time.
Practitioner guidance
- Define named ownership for every machine identity Map each service account, API key, token, and workload credential to a responsible team or business unit, and block deployment of identities that cannot be assigned an owner at creation time.
- Replace standing credentials with finite lifetimes Set explicit rotation and revocation rules for exposed or high-value secrets so that every credential has a short, enforceable lifespan and an immediate removal path.
- Move access review from approval to utilisation Use recent log activity to determine whether a permission is still needed, then remove unused entitlements from service accounts and other non-human identities.
Bottom line: Machine identity governance becomes necessary when service accounts, keys, and agents start carrying the operational load that once sat behind human identity controls.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
06/10/2026 6:33 pm
Machine identity governance is now the control plane for non-human access. The article correctly reframes NHIs as the operational layer where modern enterprise work actually happens. That means identity governance can no longer stop at human joiner-mover-leaver processes, because workloads, keys, and agents now carry real business authority. The practitioner conclusion is that NHI governance must be treated as a primary security architecture, not a subfeature of IAM.
A few things that frame the scale:
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to the Ultimate Guide to NHIs.
- DeepSeek alone generated 113,000 new exposed API keys in 2025, illustrating how new AI providers create credential exposure before security guardrails catch up, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: Should organisations prioritise secret rotation or access review first
A: They should do both, but access review should come first when unknown or over-privileged identities already exist. Rotation reduces exposure window, but review reduces entitlement sprawl and clarifies ownership. If a team rotates secrets without fixing who can use them, it preserves the same risk pattern with a fresher credential.
👉 Read our full editorial: Machine identity governance is becoming the backbone of NHI security