Topic starter
08/02/2026 10:00 pm
TL;DR: Machine identities now outnumber human identities 45 to 1, while 68% of organisations expect more SaaS deployments and 80% will use three or more cloud providers, according to CyberArk research. That scale makes unmanaged secrets and machine access a structural zero trust gap, not an edge case.
Editorial analysis by NHI Mgmt Group, based on content published by CyberArk: “Why Machine Identities Are Essential Strands in Your Zero Trust Strategy”.
By the numbers:
- Machine identities now outnumber human identities by a factor of 45:1.
- The CyberArk 2023 Identity Security Threat Landscape 2023 report finds that organizations expect an increase of 68% in the number of SaaS applications deployed in their environment.
Key questions
Q: Why do machine identities challenge zero trust architectures?
A: Because zero trust depends on continuous verification, while many machine identities are issued once and then trusted for far too long.
Q: What breaks when machine identities are not governed like first-class identities?
A: Access becomes persistent, hard to attribute, and easy to overextend across systems.
Q: How do teams reduce risk from machine identities in cloud environments?
A: Start with inventory, because you cannot govern what you cannot see.
Practitioner guidance
- Inventory machine identities and secrets Build a current inventory of applications, scripts, workloads, virtual machines and devices that authenticate with machine credentials, then classify the secrets and certificates they use.
- Automate credential issuance and revocation Replace manual handling with automated issuance, renewal and revocation so machine credentials do not outlive the workload or service they support.
- Embed controls into CI/CD pipelines Add identity checks and secret handling controls into build and deployment pipelines so machine trust is enforced before production rollout.
Bottom line: Machine identities are part of the zero trust trust boundary, and leaving them outside governance creates a structural control gap across cloud and DevOps environments.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
08/10/2026 5:21 pm
Machine identity governance is not a separate control layer, it is the trust substrate for zero trust. Zero trust only works when every identity that can authenticate and authorize itself is continuously governed, and that includes workloads, scripts, certificates and service accounts. Once machine identities outnumber human identities at enterprise scale, leaving them outside governance means the architecture is complete only for people, not for the systems that actually move data. Practitioners should treat machine identity lifecycle as foundational security architecture, not an adjunct control.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
- The 2025 Gartner Machine Identity Management in a Hybrid, Automated AI World Survey showed that 32% of organizations use mostly automated methods to manage credentials and only 1% use fully automated methods.
A question worth separating out:
Q: What should security teams do first when hardcoded secrets are discovered in code or Git history?
A: The first step is to identify every place the secret appears, assign ownership, and revoke or rotate it before treating the finding as closed. Discovery without invalidation leaves the credential usable. Teams should also check dependent systems, because one leaked secret may authenticate to cloud, source control, CI/CD, or other downstream services.
👉 Read our full editorial: Machine identity governance is a missing layer in zero trust strategy