Notifications
Clear all
Topic starter
25/06/2026 3:23 pm
TL;DR: Snowflake’s workload identity experience shows how non-human identities can quietly outnumber employees, with static credentials, manual provisioning, and inconsistent controls creating both operational drag and security exposure, according to Aembit. The lesson is that visibility alone is not enough when machine access has to be automated, policy-based, and auditable at scale.
NHIMG editorial — based on content published by Aembit: Snowflake Secures Workload Access
By the numbers:
- 69% of organisations now have more machine identities than human ones.
- Only 38% have automated certificate lifecycle management in place.
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job.
Questions worth separating out
Q: How should security teams replace static credentials for workloads?
A: They should move workloads to short-lived, policy-based authentication that issues access at runtime and removes reusable secrets from code, pipelines, and shared vaults.
Q: Why do service accounts become harder to govern at scale?
A: Service accounts become harder to govern when ownership, rotation, and usage are spread across teams and platforms without a single lifecycle view.
Q: What breaks when machine identities rely on manual provisioning?
A: Manual provisioning breaks consistency.
Practitioner guidance
- Inventory every non-human identity and owner relationship Build a complete register of applications, service accounts, pipelines, and integrations, then assign a clear owner and lifecycle state to each.
- Eliminate hardcoded and long-lived workload secrets Move workloads toward short-lived, policy-issued access and remove secrets from code, config files, and shared vault patterns that keep credentials in circulation.
- Standardise runtime policy for cross-platform access Use a single authorization model that can govern access across SaaS, cloud, and custom applications instead of letting each platform define its own credential habit.
What's in the full article
Aembit's full post covers the operational detail this analysis intentionally leaves for the source:
- Snowflake’s internal decision path for evaluating workload access options across governance tooling, cloud-native tools, and secrets managers.
- The deployment sequence across security-owned applications, CI/CD pipelines, and core enterprise workflows such as GitLab, Jira, Confluence, AWS, and Azure.
- The practical mechanics of dynamic authentication for workloads, including how policy and environmental signals were combined in the access flow.
- The adoption and audit-readiness lessons Snowflake used to persuade partner teams to follow the same model.
👉 Read Aembit’s analysis of Snowflake’s workload identity approach →
NHI sprawl and static credentials: what security teams need to know?
Explore further
25/06/2026 4:54 pm
Machine identity sprawl changes the control problem before it changes the toolset. Once non-human identities outnumber employees, governance moves from managing exceptions to managing the default state of access. The relevant frameworks are OWASP-NHI and Zero Trust, because the primary failure mode is not a single exposed secret but an environment where no team can reliably enumerate, classify, or retire every workload identity. Practitioners should treat this as a lifecycle and inventory problem first, and a tooling problem second.
A few things that frame the scale:
- 69% of organisations now have more machine identities than human ones, according to The Critical Gaps in Machine Identity Management report.
- 53% of organisations have experienced a security incident directly related to machine identity management failures, according to SailPoint.
A question worth separating out:
Q: How do you know workload identity controls are actually working?
A: You should be able to show that access is issued without static secrets, that every workload has a clear owner, and that audit logs reconstruct identity, policy, and destination for each transaction. If those three signals are missing, the control is reducing effort but not yet governing risk.
👉 Read our full editorial: Snowflake’s NHI sprawl shows why static credentials no longer scale
