Topic starter
22/07/2026 4:35 pm
TL;DR: Non-human identities now outnumber human identities by 50:1 or more in many enterprise environments, while only 5.7% of organisations can accurately inventory all NHIs, according to Silverfort’s analysis. Secrets rotation helps reduce exposure, but it does not solve discovery, ownership, posture, or runtime enforcement across the full NHI estate.
Editorial analysis by NHI Mgmt Group, based on content published by Silverfort: “6 principles for securing non-human identities (NHIs)”.
By the numbers:
- Non-human identities now outnumber human identities by ratios of 50:1 or more in enterprise environments.
- Only 5.7% of organisations report being able to accurately inventory all NHIs in their environment.
Key questions
Q: What breaks when organisations rely on secret rotation alone for NHI protection?
A: When organisations rely on rotation alone, they often assume a control is working when it only reduces exposure on a schedule.
Q: Why do static NHI credentials create more risk than human credentials in cloud environments?
A: Static NHI credentials are reusable, often high privilege, and usually lack the human controls that limit user accounts, such as MFA and session review.
Q: How do security teams know if NHI governance is actually working?
A: A working NHI programme shows clear ownership, short-lived credentials, frequent revocation, and low numbers of dormant or shared machine accounts.
Practitioner guidance
- Build a unified NHI inventory Aggregate service accounts, API keys, OAuth tokens, and cloud workload identities across Active Directory, cloud platforms, SaaS, DevOps, and AI systems into one governed record.
- Map every NHI to an accountable owner Use metadata, tagging, environment signals, and automated workflows to assign a human or team owner to each identity before remediation decisions are made.
- Prioritise behavioural posture over static configuration Score over-privilege, dormancy, and exposed secrets by observed behaviour and actual usage, not only by what permissions are configured on paper.
Bottom line: NHI security is failing less because secrets are not rotated and more because the organisation lacks a governable model for discovery, ownership, and runtime control.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 5 days ago by NHI Mgmt Group
22/07/2026 4:41 pm
Secret rotation is necessary, but it is not a governance model. Rotation reduces one exposure mode, yet it leaves discovery, ownership, entitlement scope, and runtime enforcement unresolved. That is why organisations can rotate credentials and still remain unable to answer who owns an NHI, where it lives, or what it may do. The practical conclusion is that machine identity security must be managed as an operating model, not a hygiene task.
A few things that frame the scale:
- 61% of organisations still define privileged users as humans only, overlooking the role of non-human identities in privileged access, according to KPMG.
A question worth separating out:
Q: Should organisations treat service accounts and AI agents under the same authorization model?
A: Yes. Service accounts, AI agents, and other workloads are all non-human principals that need centrally governed access decisions, even if their runtime behaviour differs. Treating them under one authorization model reduces blind spots, exposes overprivilege faster, and gives security teams a common way to enforce least privilege across delegated machine identity.
👉 Read our full editorial: NHI security needs a governance model, not just secret rotation
This post was modified 5 days ago by NHI Mgmt Group