The NHI problem is bigger than discovery
TL;DR: The industry has rallied around discovering non-human identities. Discovery is step 1 of 10. An NHI you can see but cannot govern is just a documented liability.
The scale nobody planned for
Non-human identities — service accounts, API keys, machine credentials, bot tokens, CI/CD runners — outnumber human identities roughly 3:1 in the average enterprise. In cloud-native environments, the ratio is closer to 10:1. Every microservice, every Terraform pipeline, every SaaS integration spawns credentials that live outside the identity lifecycle you built for people.
Most organizations have no idea how many NHIs they have. The ones that do found out the same way: a vendor ran a scan and delivered a number that made the CISO pause. "We found 47,000 non-human identities in your environment."
That number is real and it matters. But what happens after you have it?
The discovery trap
Discovery is genuinely valuable. You cannot govern what you cannot see, and most enterprises cannot see the majority of their NHIs. The discovery vendors are solving a real problem.
SailPoint acquired Entro for NHI discovery. CrowdStrike, Astrix, and Silverfort have all invested seriously in the visibility layer — scanning vaults, cloud IAM, CI/CD pipelines, and SaaS platforms to enumerate machine credentials. This is hard engineering work and the results are useful.
But the deliverable is an inventory. And an inventory is not governance.
Discovery answers the question: What NHIs exist? It does not answer: Who owns this service account? When was it last rotated? What can it access? Has anyone reviewed that access in the last 90 days? Does it violate a separation-of-duties policy? If I revoke it right now, what breaks? And can I prove all of this to an auditor?
Those are the questions that matter at 2 AM during an incident. Those are the questions auditors ask. And those are the questions that discovery tools, by design, do not answer.
The ten things that come after discovery
Discovery is step 1. Here are the other nine:
- Ownership assignment — every NHI must have a human owner accountable for its existence and behavior.
- Risk scoring — not all NHIs are equal. A read-only reporting bot is not the same as a service account with production database write access.
- Birthright provisioning — when a new service is created, what access does it get by default, and who approved that baseline?
- Lifecycle management — creation, rotation schedules, expiry dates, automatic deprovisioning when the owning service is decommissioned.
- Access reviews — periodic, manager-certified reviews of what each NHI can reach, with the same rigor applied to human access reviews.
- Certification campaigns — time-bound, auditable campaigns where owners certify or revoke NHI access across the organization.
- Separation-of-duties checks — a CI/CD service account should not also have production change-management access. These conflicts must be detected and enforced.
- Closed-loop revocation — when access is revoked in the governance layer, the revocation propagates to the target system and is confirmed. No orphaned permissions.
- Cryptographic evidence — every decision — grant, deny, certify, revoke — produces a signed, hash-chained record that the tenant can verify offline without the vendor.
Skip any one of these and you have a gap an auditor will find or an attacker will exploit. Discovery alone covers zero of them.
The ticking time bomb
A service account with no owner, no rotation schedule, and no access review is a ticking time bomb. It sits in your environment with standing privileges, and nobody is watching it. Nobody is rotating its credentials. Nobody is reviewing whether it still needs the access it was granted eighteen months ago when the project that created it was in a completely different phase.
Discovery tells you the bomb exists. Governance tells you it is safe — or removes it.
The breaches that make headlines are not caused by identities nobody knew about. They are caused by identities everybody knew about but nobody governed. The Okta breach started with a service account. The Codecov supply-chain attack pivoted through CI/CD credentials. In every post-mortem, the credentials were known. The governance was absent.
What we built, and why
I spent years building IGA systems for human identities. When we started SidantiX, the question was straightforward: why would you govern machine credentials differently from human credentials? The risks are the same. The audit requirements are the same. The lifecycle is the same — creation, access grants, reviews, rotation, deprovisioning.
So we did not build a separate NHI module. Non-human identities run through the same governance pipeline as human identities and AI agents. Same birthright provisioning. Same certification campaigns. Same access-review workflows. Same separation-of-duties policy engine. Same closed-loop revocation. Same cryptographic evidence.
Concretely, every NHI in the system is:
- Registered — discovered and recorded with type, source system, and creation context.
- Owned — assigned to a human owner who is accountable during reviews and incidents.
- Scored — risk-ranked based on privilege level, blast radius, rotation age, and access patterns.
- Reviewed — included in periodic access reviews and certification campaigns alongside human identities.
- Governed — subject to SoD checks, lifecycle policies, and rotation enforcement.
- Evidenced — every governance decision produces a cryptographically signed, hash-chained receipt stored in the tenant's own infrastructure.
The difference between an inventory and a registry is accountability. An inventory tells you what exists. A registry tells you what exists, who is responsible for it, whether it is compliant, and can prove it to an auditor without a three-week forensics engagement.
What to do Monday morning
If you are evaluating NHI solutions, ask every vendor four questions:
- After discovery, can you assign an owner to every NHI and enforce ownership reviews?
- Can you run certification campaigns on NHIs with the same workflow you use for humans?
- When you revoke an NHI's access, does the revocation propagate to the target system and confirm?
- Can I verify every governance decision offline, with my own keys, without calling your support team?
If the answer to any of those is no, you have a discovery tool. Discovery is necessary. But it is not sufficient.
If you want to see how we handle NHI governance specifically, Self Experience lets you walk through it in your browser. Or reach out directly — I am happy to talk through the architecture.