What breaks when organisations rely on spreadsheets for machine identity management?

Why This Matters for Security Teams

Spreadsheets do not fail because they are “old”; they fail because machine identity operations are continuous, high-volume, and time-sensitive. When certificates, service accounts, and API keys are tracked manually, the organisation loses the one thing that matters most in identity security: reliable lifecycle control. That creates stale ownership, missed renewals, and blind spots in revocation, all of which turn routine administration into incident exposure. NHI Management Group research shows that 61% of organisations still rely on spreadsheets or manual tracking for machine identity management, a gap that maps directly to the outage and breach patterns documented in The Critical Gaps in Machine Identity Management report.

The operational issue is not simply recordkeeping. Spreadsheets cannot enforce policy, cannot validate expiry, and cannot prove whether an identity was rotated, revoked, or reissued. That makes them fundamentally incompatible with the governance expectations described in Ultimate Guide to NHIs and with the control discipline expected by NIST Cybersecurity Framework 2.0.

In practice, many security teams only discover the scale of the problem after an expired certificate or orphaned secret has already disrupted production.

How It Works in Practice

A spreadsheet-based process usually starts with a list of hosts, owners, certificate expiry dates, and maybe a renewal note. It breaks down as soon as that list stops being authoritative. Machine identities move faster than the document that tracks them: workloads are rebuilt, automation issues new tokens, teams change ownership, and ephemeral secrets expire before the next manual review. If the sheet is not updated at the same pace, the organisation is no longer managing identities, it is managing historical guesses.

Practically, the failure chain looks like this:

• Ownership is unclear, so renewal tickets sit unassigned.
• Expiry dates are copied incorrectly or never refreshed after reissuance.
• Secrets are left in code, config files, or CI/CD tooling after the workload changes.
• Revocation is delayed because no one can confirm which identity is still in use.

This is why guidance increasingly points toward lifecycle automation, inventory validation, and continuous reconciliation rather than periodic review. The operational model described in Ultimate Guide to NHIs — Lifecycle Processes for Managing NHIs is materially closer to what is needed: inventory, issuance, rotation, renewal, and decommissioning must be tied to actual system state, not document state. For implementation direction, NIST Cybersecurity Framework 2.0 supports the broader governance expectation to identify, protect, detect, respond, and recover across identity assets.

The best practice is to treat the spreadsheet, if it exists at all, as a temporary reporting artifact, not the system of record. These controls tend to break down when certificate volume rises across hybrid, multi-team, or CI/CD-heavy environments because manual reconciliation cannot keep pace with machine identity churn.

Common Variations and Edge Cases

Tighter manual control often increases overhead, requiring organisations to balance visibility against operational speed. That tradeoff is real in smaller estates, where a spreadsheet may appear workable for a limited number of certificates or service accounts. Current guidance suggests that this can be acceptable only as a short-lived bridge, not a steady-state operating model.

The edge cases are usually the ones that create the most risk:

• Short-lived workloads generate identities faster than humans can update records.
• Third-party integrations introduce identities that internal teams do not own directly.
• Hybrid estates split responsibility across cloud, on-prem, and DevOps teams.
• Exception handling becomes informal, so “temporary” access survives for months.

That is also where spreadsheet dependence masks deeper NHI issues such as excessive privilege, incomplete offboarding, and poor visibility into where secrets live. The broader risk picture is covered in Top 10 NHI Issues and in the breach patterns analysed in 52 NHI Breaches Analysis. A simple spreadsheet may help with initial tracking, but it does not provide trustworthy ownership, auditability, or automated enforcement. In practice, that means it is useful for reporting yesterday’s state, not preventing tomorrow’s failure.

Related resources from NHI Mgmt Group

• When does a machine identity become a compliance problem?
• What breaks when organisations treat AI governance as a separate security program?
• How should organisations start planning for quantum-safe identity and trust systems?
• How can organisations decide which identity risks to fix first?