Topic starter
10/06/2026 11:10 pm
TL;DR: Non-human identities outnumber human users by roughly 17 to 1 in most organisations, and many teams still lack visibility into what service accounts and workload identities do at runtime, according to Cerbos. The missing control is not rotation alone but request-level authorization, because standing overprivilege turns every valid secret into an unnecessary blast radius.
Editorial analysis by NHI Mgmt Group, based on content published by Cerbos: “Non-Human Identity management still has a blind spot”.
By the numbers:
- Non-human identities now outnumber human users in most organisations by roughly 17 to 1.
- A company cited in the article had 2,500 internal users but over 4,500 services and workloads.
- Only 15% of organisations feel confident in their ability to secure NHIs, according to the NHI Management Group.
Key questions
Q: What breaks when NHI governance relies on inventory alone?
A: Inventory alone tells you what credentials exist, but not whether they are active, over-scoped, shared, or being used by an agent at runtime.
Q: Why do service accounts with standing privilege increase cloud blast radius?
A: Standing privilege increases blast radius because a compromised service account can be used immediately, often with broad read access and trusted role paths.
Q: How do security teams know if NHI controls are actually working?
A: Look for complete inventory coverage, clear ownership, enforced rotation, and evidence that unused credentials are removed on time.
Practitioner guidance
- Implement request-level authorization for critical NHI flows Start with the highest-value service-to-service interactions and define policies for the exact actions and resources each identity needs, rather than granting service-wide access.
- Separate authentication from authorization decisions Use workload identity or mutual TLS to establish identity, then send the request context to a policy decision point so allow or deny is evaluated centrally.
- Reduce service-level privilege grants Replace broad IAM roles with finer-grained rules that distinguish between read, write and administrative operations on the same target system.
Bottom line: NHI governance that focuses only on discovery, rotation and lifecycle management leaves the core privilege question unresolved.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 5 days ago by NHI Mgmt Group
12/06/2026 5:00 am
Runtime authorization is the missing layer in NHI governance: identity inventory, secret rotation and lifecycle management reduce exposure, but they do not decide whether a request should be allowed. That decision has to happen at runtime, because overprivilege is a policy problem, not just a credential problem. The practitioner conclusion is straightforward: if access is only checked at authentication, the governance model is incomplete.
A few things that frame the scale:
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to the Ultimate Guide to NHIs.
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What happens when a service account is authenticated but not authorised precisely?
A: The workload can pass identity checks and still obtain broad access because the policy boundary is too coarse. That means the organisation has authenticated the caller but has not limited what the caller can do. In practice, this is where valid credentials become unnecessary risk.
👉 Read our full editorial: Runtime authorization is the missing layer in NHI governance
This post was modified 5 days ago by NHI Mgmt Group