Topic starter
08/01/2026 5:59 pm
TL;DR: Machine identities now outnumber human users by 25 to 50 per person in many organisations, and the article argues that zero trust remains incomplete unless APIs, workloads, bots, and devices are authenticated, authorised, and continuously monitored with lifecycle controls, according to Token Security. The core issue is that machine trust assumptions break when identities are created, rotated, and deactivated at machine speed.
Editorial analysis by NHI Mgmt Group, based on content published by Token Security: “Zero Trust for Machines: How Non-Human Identities Fit In”.
By the numbers:
- Machine identities now outnumber human users by 25 to 50 per person in many organisations.
Key questions
Q: What breaks when machine identities are excluded from Zero Trust policy?
A: Zero Trust breaks when machine identities are excluded because service accounts and workloads often generate the highest-volume internal access.
Q: What problem does ownership attribution solve for service accounts and API keys?
A: It closes the gap between exposure detection and accountable remediation.
Q: How do teams know whether machine identity controls are actually working?
A: Look for complete inventory coverage, clear ownership, regular credential rotation, and the ability to revoke access quickly without breaking dependent services.
Practitioner guidance
- Map machine identities as a governed inventory Record service accounts, API keys, certificates, bots, workloads, and device identities in one ownership model so trust decisions can be applied consistently.
- Automate rotation and deactivation Replace manual renewal and offboarding steps with automated certificate renewal, token regeneration, and immediate identity removal when workloads disappear.
- Enforce least privilege for every machine request Scope each identity to a single workflow, endpoint, or dataset and remove broad access that creates hidden lateral movement paths.
Bottom line: Machine identities are not a side issue in zero trust, because they now carry a volume of access that can exceed human identity by orders of magnitude.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
06/10/2026 6:31 pm
Zero trust is incomplete when machine identities are treated as secondary actors. The article shows that workloads, APIs, bots, containers, and devices now make access decisions that matter as much as human logins. Once that happens, the trust boundary shifts from user authentication to machine identity governance. Practitioners need to treat machine identity as a primary control plane, not an edge case.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What should teams do when machine identity policy is spread across many tools?
A: Consolidate governance around one identity-first policy model so the same machine receives the same authorization outcome everywhere. Fragmented policy creates gaps that over-permissioned service accounts, expired certificates, and shadow identities can exploit.
👉 Read our full editorial: Zero trust for machine identities demands lifecycle control