Notifications
Clear all
Topic starter
22/07/2026 4:35 pm
TL;DR: Non-human identities now outnumber human identities by 50:1 or more in many enterprise environments, while only 5.7% of organisations can accurately inventory all NHIs, according to Silverfort’s analysis. Secrets rotation helps reduce exposure, but it does not solve discovery, ownership, posture, or runtime enforcement across the full NHI estate.
NHIMG editorial — based on content published by Silverfort: Non-human identities need more than secrets management
By the numbers:
- Only 5.7% of organizations report being able to accurately inventory all NHIs in their environment.
- 80% of NHIs have high or critical posture issues that expose them to common attack techniques.
Questions worth separating out
Q: How should teams reduce the risk from exposed NHI secrets?
A: Teams should combine secret discovery, immediate revocation, enforced rotation, and tighter access controls around repositories, logs, and collaboration tools.
Q: Why are NHIs harder to govern than human identities?
A: NHIs are often hidden in code, automation tools, and infrastructure configurations and lack centralised ownership.
Q: What do security teams get wrong about secret rotation?
A: They often treat rotation as a substitute for removing the underlying credential model.
Practitioner guidance
- Build a unified NHI inventory Aggregate service accounts, API keys, OAuth tokens, and certificates across cloud, SaaS, DevOps, and directory systems so ownership and usage can be correlated in one place.
- Map every NHI to a responsible owner Use metadata, naming conventions, tagging, and behavioural signals to assign a business or technical owner before remediation workflows begin.
- Prioritise posture by observed behaviour Compare what each NHI is permitted to do against what it actually does, then focus remediation on unused permissions, dormant identities, and repeated secret exposure.
What's in the full article
Silverfort's full article covers the operational detail this post intentionally leaves for the source:
- Detailed workflow guidance for building a unified NHI inventory across cloud, SaaS, and DevOps systems
- Examples of posture findings based on behaviour, ownership, and exposure signals
- Practical remediation patterns for rotating secrets, restricting access, and automating lifecycle actions
- Runtime enforcement approaches for limiting what compromised NHI credentials can do
👉 Read Silverfort's analysis of NHI governance, posture, and runtime enforcement →
NHI governance is the gap secret rotation does not close?
Explore further
22/07/2026 4:41 pm
NHI security is no longer a secrets problem, it is an identity governance problem. Secrets rotation reduces one exposure mode, but it does not solve discovery, ownership, lifecycle, or runtime enforcement. The article is correct to frame the issue as a full-NHI governance gap rather than a tooling gap. Organisations that keep treating these identities as isolated credentials will continue to miss the relationships that create blast radius.
A few things that frame the scale:
- Only 5.7% of organizations report being able to accurately inventory all NHIs in their environment, according to The 2025 State of NHIs and Secrets in Cybersecurity.
- 91% of former employee tokens remain active after offboarding, according to The 2025 State of NHIs and Secrets in Cybersecurity.
A question worth separating out:
Q: How can organisations tell whether NHI governance is actually working?
A: NHI governance is working when every machine identity has an owner, a purpose, a minimum-necessary entitlement, and evidence of rotation and review. If teams can produce that chain without manual reconstruction, the programme is mature enough to withstand audit pressure. If they cannot, the governance model is still fragmented.
👉 Read our full editorial: NHI security needs a governance model, not just secret rotation
