Topic starter
17/08/2026 4:40 pm
TL;DR: Akeyless says machine identities now outnumber human identities 45 to 1 and will more than double in 18 months, while mismanaged secrets remain a primary breach path across the MITRE ATT&CK lifecycle. Static credentials, weak RBAC, and missing JIT controls keep exposure windows open longer than most identity programmes assume.
Editorial analysis by NHI Mgmt Group, based on content published by Akeyless: “How the MITRE ATT&CK Framework Can Improve Your Cybersecurity Posture”.
By the numbers:
- For every human identity, there are 45 machine identities today, and this will more than double in the next 18 months.
Key questions
Q: What breaks when shared machine secrets are not removed from the operating model?
A: What breaks is not just storage discipline but the trust model itself.
Q: Why do static credentials increase the blast radius of a compromise?
A: Static credentials increase blast radius because they remain valid across multiple sessions and often carry permissions broader than a single task.
Q: How do identity teams know whether secrets governance is actually working?
A: Identity teams know secrets governance is working when they can prove that every active secret has an owner, an approved scope, and a tested revocation path.
Practitioner guidance
- Map secrets to ATT&CK stages Inventory the machine secrets that can support initial access, credential access, escalation, and lateral movement, then rank them by the attack stages they can enable.
- Replace standing secrets with dynamic issuance Prioritise workloads where a static credential can be swapped for short-lived, task-scoped access so that compromise has less time to propagate.
- Tighten NHI role boundaries Review service-account and application roles for unnecessary privileges, especially where one credential can reach multiple systems or environments.
Bottom line: Machine identities create a much larger credential surface than human accounts, and static secrets keep that surface exploitable for longer than most programmes can tolerate.
What's in the full article
Akeyless's full blog post covers the operational detail this post intentionally leaves for the source:
- The ATT&CK stage-by-stage examples that show where secrets management interrupts attacker progression
- The white paper’s 16 pages of practical guidance on mapping controls to credential-based attack paths
- The platform-specific explanation of dynamic secrets, RBAC, and JIT access in the source article
- The secretless and SPIFFE discussion that expands beyond the high-level governance view
👉 Read Akeyless's analysis of secrets management and MITRE ATT&CK for NHI attack paths →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
17/08/2026 4:45 pm
Secrets management is now an attack-path control, not just a vaulting discipline. The article is right to place ATT&CK alongside secrets management because the central problem is not storage alone but adversary replayability across infrastructure stages. Once a secret can be reused across workflows, the control question becomes how much of the attack lifecycle it can still support. Practitioners should treat credential lifecycle as a defensive boundary, not a back-office process.
A few things that frame the scale:
- 62% of organisations are at least experimenting with AI agents, but only 23% have scaled one into a single business function, according to McKinsey's 2025 State of AI survey.
A question worth separating out:
Q: How should IAM teams use ATT&CK when hardening NHI controls?
A: Use ATT&CK as the translation layer between identity controls and adversary behaviour. Map where credentials enable initial access, where privilege expands, and where lateral movement becomes possible, then align each stage to a control owner. That makes secrets management a detection and containment strategy, not only a compliance activity.
👉 Read our full editorial: Secrets management and MITRE ATT&CK: closing NHI attack paths