Topic starter
25/06/2026 1:07 am
TL;DR: Enterprise identity management is under strain because non-human identities now outnumber human identities 45:1 in cloud environments, while many organisations still depend on static roles and manual provisioning, according to Apono. That gap turns credential sprawl, orphaned access, and compliance drift into structural risk rather than isolated hygiene issues.
Editorial analysis by NHI Mgmt Group, based on content published by Apono: “What is Enterprise Identity Management?”.
By the numbers:
- By 2025, non-human identities will outnumber human identities by 45:1 in cloud environments, according to Apono.
Key questions
Q: What breaks when non-human identities are managed outside the IAM operating model?
A: What breaks is accountability.
Q: What problem does ownership attribution solve for service accounts and API keys?
A: It closes the gap between exposure detection and accountable remediation.
Q: How can organisations tell whether NHI governance is actually working?
A: NHI governance is working when every machine identity has an owner, a purpose, a minimum-necessary entitlement, and evidence of rotation and review.
Practitioner guidance
- Map every non-human identity to an owner and purpose Create an inventory that links each service account, API key, token, and certificate to a business purpose, technical owner, and expiry expectation.
- Replace static roles with task-scoped access Use just-in-time access for elevated machine privileges where the access window can be tied to deployment, incident response, or automation windows.
- Automate rotation and expiry for machine credentials Set rotation and expiry rules for API keys, tokens, and service account secrets based on usage and risk, not calendar convenience.
Bottom line: Enterprise identity management is failing because cloud environments now depend on machine identities that do not fit human-centric IAM workflows.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
25/06/2026 10:18 am
Static IAM assumptions no longer match cloud identity reality: Enterprise identity management was built around people with discrete join, move, and leave events. That assumption fails when the dominant access subjects are service accounts, API keys, and bots that are created, embedded, and forgotten inside delivery pipelines. The implication is that lifecycle governance must move from user-centric administration to machine-centric control.
A few things that frame the scale:
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to the Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: When should organisations use just-in-time access for manufacturing identities?
A: Organisations should use just-in-time access for identities that support temporary maintenance, vendor support, or emergency intervention. JIT is most valuable when standing access would create unnecessary blast radius. It works best when the approval path, session duration, and rollback steps are pre-defined and tied to production schedules and safety requirements.
👉 Read our full editorial: Enterprise identity management is failing to keep up with NHI sprawl
This post was modified 1 day ago by NHI Mgmt Group