Somewhere in most large enterprises, a service account created for a project that ended two years ago still has write access to a production database. Nobody remembers why. Nobody wants to be the one who revokes it and breaks something at 2 a.m. So it stays.
This is the quiet failure mode of modern identity security, and it has almost nothing to do with employees clicking phishing links. The fastest-growing category of credentials inside enterprise environments belongs to machines: service accounts, API keys, OAuth tokens, container identities, CI/CD pipeline credentials, IoT device certificates, and the growing population of AI agents that now authenticate to systems on their own schedule. Security teams have spent two decades building governance around human identity — onboarding, offboarding, access reviews, multi-factor authentication. Machine identity has mostly grown in the dark.
A Population Nobody Is Counting
Ask a CISO how many employees have access to a given system, and there’s usually an answer, even if it takes a day to produce. Ask how many non-human identities have access to that same system, and the honest answer in many organizations is a shrug. Every microservice spun up in a cloud environment can generate its own identity. Every SaaS integration issues tokens. Every automation script, Kubernetes pod, and now every autonomous AI agent carries credentials that were provisioned once, rarely reviewed, and almost never expired on a predictable schedule.
The ratio of machine identities to human ones has been climbing for years, and in cloud-native environments it isn’t close — machine credentials commonly outnumber human accounts by a wide margin, sometimes by an order of magnitude or more, depending on how aggressively an organization has adopted microservices and automation. The trend line matters more than any single figure: it points in one direction, and governance has not kept pace.
Why This Happened Quietly
No single decision created this. It’s the accumulated residue of infrastructure choices that each made sense in isolation. Moving to microservices meant more services, each needing to authenticate to others. Adopting CI/CD pipelines meant build systems needing broad permissions to deploy code. Integrating SaaS tools meant handing out API keys that often default to far more scope than the integration actually uses, because narrowing permissions takes engineering time nobody budgeted for. And now, AI agents that can call APIs, move data, and trigger workflows are being issued credentials under the same loose norms — provisioned quickly, documented rarely, revisited almost never.
The result is an attack surface that looks nothing like the org chart. A compromised service account can often move laterally with less friction than a compromised human login, because service accounts rarely trigger the same monitoring: no failed-login lockouts tuned for bots, no geographic anomaly detection calibrated for machines, no security awareness training to fall back on. When a non-human credential is stolen or leaked — in a public code repository, a misconfigured secrets manager, a third-party breach — it frequently sits undetected far longer than a human account compromise would.
The Ownership Gap
Part of the problem is structural. Human identity has an owner: HR triggers onboarding and offboarding, IT provisions accounts, security reviews access. Machine identity has no equivalent lifecycle owner in most organizations. A developer creates a service account to unblock a deployment, and that account outlives the project, the developer’s tenure, and sometimes the application it was built for. Nobody is assigned to ask whether it still needs to exist.
This is compounded by tooling gaps. Identity governance platforms built for human access reviews often don’t handle the scale or churn of machine credentials well — a quarterly access review process designed for a few thousand employees breaks down when applied to tens of thousands of ephemeral service identities that come and go with every deployment. Some organizations have started standing up separate machine identity governance programs, distinct from traditional IAM, with their own inventory, ownership assignment, and expiration policies. Others are still treating it as a subset of a problem they already think they’ve solved.
What a Reasonable Program Looks Like
The organizations making progress here tend to start with inventory, however unglamorous that sounds. A credential that isn’t catalogued can’t be governed. That means discovering every service account, API key, and certificate across cloud environments, CI/CD systems, and SaaS integrations — not a one-time audit, but a continuous process, since new machine identities are created constantly.
From there, the practical levers are familiar ones applied to an unfamiliar population: assign an owner to every non-human credential, the way every human account has a manager. Set expiration dates by default rather than issuing indefinite access. Scope permissions to the minimum required for the task, and revisit that scope when the task changes. Rotate secrets on a schedule instead of leaving keys valid until someone notices a problem. And feed machine identity activity into the same monitoring pipelines used for human behavior, so that a service account authenticating from an unusual location or at an unusual volume gets flagged the way a suspicious employee login would.
That last point runs into a cost problem many security and platform teams are already fighting on a separate front: the sheer volume of telemetry involved in watching machine identity behavior at scale adds directly to the logging and monitoring bill, a tension explored in more detail in an earlier look at why observability spending has become harder to control. Identity governance and observability spend are no longer separate budget lines — watching machines behave suspiciously requires the same pipelines straining under cost pressure elsewhere.
None of this is dramatic work. It’s inventory, ownership, expiration, and scope — the unglamorous mechanics of governance applied to a population that grew up without any. But the alternative is an attack surface that keeps expanding invisibly, one forgotten service account at a time, in an environment where the humans are watched far more closely than the machines acting on their behalf.
