Machine identities outnumber people; few organisations can list them
In plain words: Computer programs hold far more passwords and keys than people do, and most organisations cannot list them or say who looks after each one. Identity and access, explained simply
In short
- For every person in an organisation there are now dozens of machine identities: service accounts, API keys, OAuth tokens, certificates, and the credentials that scripts, pipelines and AI agents use. One large survey puts the ratio at 82 to 1.
- Unlike people, these identities have no joiner, mover and leaver process. Nobody notices when they are no longer needed, so they are rarely switched off and their secrets rarely change.
- The first job is not a new tool. It is a list: every machine identity, what it can reach, who owns it, and when its secret expires.
How big the gap is
CyberArk's 2025 Identity Security Landscape surveyed 2,600 security decision makers in 20 countries. They reported 82 machine identities for every human one, and said 42% of those machine identities have access to sensitive or privileged systems. Yet 88% said their definition of a "privileged user" covers only people. A vendor survey is not a census, so read the exact numbers with care, but the direction matches what anyone who has tried to count will find.
The secrets behind these identities also leak. GitGuardian found about 23.8 million new secrets in public GitHub repositories during 2024, and around 70% of the secrets it found leaked in 2022 still worked. Private repositories were worse, not better: 35% of them contained at least one secret.
Where it actually breaks
In November 2023 an attacker got into Cloudflare's internal wiki, ticketing system and source code. The way in was one access token and three service account credentials stolen weeks earlier in the Okta support breach. Cloudflare had rotated thousands of credentials after that breach and missed those four, "because mistakenly it was believed they were unused." The clean-up afterwards meant rotating every production credential, more than 5,000 of them.
In August 2025 Google's threat intelligence team described a group that used stolen OAuth tokens from the Salesloft Drift chat integration to pull data out of many organisations' Salesforce instances. The tokens belonged to an integration, not to a person, so no one's sign-in was challenged. The attackers then searched the stolen data for more secrets, such as cloud access keys and passwords. Google's advice was to treat every token connected to the integration as compromised, and to revoke and rotate them.
Both stories have the same shape. The credentials worked, nobody was watching them, and no one could quickly say which ones existed or what they opened.
Why they escape the usual controls
People leave, change roles and get reviewed. Machine identities do none of that. A developer creates a service account for a project, the project ends, and the account carries on with the access it had on its last day. OWASP's Non-Human Identities Top 10 for 2025 reads like a list of those habits: improper offboarding first, then leaked secrets, risky third-party identities, too much privilege, long-lived secrets, and people signing in with a machine's account.
My own view is that the root problem is ownership. An identity with no named owner has no one to ask whether it is still needed, so the safe answer, "leave it", wins every time.
What to do on Monday
- Build the list. Pull service accounts from the directory, keys and roles from each cloud account, OAuth grants from your main software-as-a-service platforms, and certificates from your certificate tooling. Expect it to be bigger than anyone guesses.
- Give every entry an owner who can say why it exists. Disable what nobody claims after a fixed period, and delete it later if nothing breaks.
- Shorten the life of secrets. Prefer workload identity and short-lived tokens over static keys, and set an expiry on everything that cannot change yet.
- Scan code repositories, private ones included, and ticketing and chat tools for secrets, and rotate what you find.
- Treat third-party integrations as part of the list. When a supplier is breached, you should be able to say within hours which tokens it held.
Sources
- CyberArk, 2025 Identity Security Landscape: machine identities outnumber humans by more than 80 to 1 (press release, April 2025).
- GitGuardian, The State of Secrets Sprawl 2025 (March 2025).
- Cloudflare, Thanksgiving 2023 security incident (February 2024).
- Google Threat Intelligence Group, Widespread data theft targets Salesforce instances via Salesloft Drift (August 2025).
- OWASP, Non-Human Identities Top 10, 2025 (2025).
Personal work and my own view, not my employer's. Sources are public.