Topic starter
25/06/2026 3:23 pm
TL;DR: Snowflake’s workload identity experience shows how non-human identities can quietly outnumber employees, with static credentials, manual provisioning, and inconsistent controls creating both operational drag and security exposure, according to Aembit. The lesson is that visibility alone is not enough when machine access has to be automated, policy-based, and auditable at scale.
Editorial analysis by NHI Mgmt Group, based on content published by Aembit: “The Story Behind Snowflake’s Push to Rein in Non-Human Identities”.
Key questions
Q: What breaks when workload access still depends on static secrets?
A: Static secrets create persistent access paths that outlive the workload, which makes compromise easier to exploit and harder to contain.
Q: Why do long-lived service account secrets increase breach risk?
A: They extend the window in which a leaked or reused credential remains valid, so a single exposure can become persistent access.
Q: How can organisations tell whether NHI governance is actually working?
A: NHI governance is working when every machine identity has an owner, a purpose, a minimum-necessary entitlement, and evidence of rotation and review.
Practitioner guidance
- Audit long-lived machine credentials Identify service accounts, application secrets, and CI/CD credentials that remain valid beyond their business need, then rank them by reuse, blast radius, and ownership clarity.
- Replace static access with policy-based issuance Move the highest-risk workload connections to request-time credential issuance so access is based on policy and current context rather than stored secrets.
- Map workload identity ownership Assign explicit owners for every non-human identity used by applications, pipelines, and integrations so offboarding and rotation are accountable, not ad hoc.
Bottom line: Snowflake’s experience shows that NHI sprawl becomes a governance problem when static credentials, manual provisioning, and inconsistent ownership accumulate across workloads.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
25/06/2026 4:54 pm
Static credential sprawl is the failure mode, not just a hygiene issue. Snowflake’s story shows that long-lived machine credentials become a governance liability once the NHI estate expands faster than human oversight. The problem is not merely the presence of secrets, but the fact that those secrets outlive the operational need, circulate across teams, and bypass any consistent identity lifecycle. Practitioners should treat static credential sprawl as a control-plane failure.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should teams prioritise workload identity over more secrets management?
A: Yes, when the core problem is reusable credentials rather than storage. Secrets management can hide and organise credentials, but workload identity changes the access model itself by removing the need for persistent secrets in many cases. That is a stronger control when machine access is large-scale and continuous.
👉 Read our full editorial: Snowflake’s NHI sprawl shows why static credentials no longer scale
This post was modified 1 day ago by NHI Mgmt Group