Photo by Taylor Vick on Unsplash
The Evidence: 287 Days
Two hundred and eighty-seven days. That is the average time it takes to discover a compromised machine credential, according to IBM's 2024 Cost of a Data Breach Report — against 21 days for a compromised human credential. As of August 15, 2026, that gap remains the single most under-discussed number in identity security, and it is worth sitting with for a moment. A stolen employee password gets caught in about three weeks. A stolen API key gets caught in about nine and a half months — roughly 13.7 times longer.
That ratio is the whole story. It is not that machine identities are attacked more cleverly. It is that once a threat actor has one, the clock effectively stops running.
According to refresh, whose reporting on the machine identity blind spot prompted this analysis, the underlying problem is scale: service accounts, API keys, OAuth tokens, SSH keys, and certificates now outnumber human identities by 45:1 in enterprise environments as of 2024, per Gartner. The average enterprise manages more than 250,000 machine identities against only 5,000 to 50,000 human ones. Gartner's research further finds that most organizations cannot inventory 60% of their non-human identities (NHIs) — the credentials software uses to authenticate to other software, with no person typing anything.
What the Surface Reporting Misses
The standard framing of this story is "there are a lot of machine identities and that is scary." The more useful framing is what happens when you multiply the scale gap by the detection gap.
Run the arithmetic. A mid-size enterprise sitting at the 45:1 ratio with, say, 5,000 employees is carrying roughly 225,000 machine identities. Gartner's finding that 60% of NHIs cannot be inventoried means about 135,000 of those credentials exist without an owner, a rotation schedule, or a monitoring rule. Now apply the IBM detection figures: each of those 135,000 unmanaged credentials, if compromised, buys an attacker roughly 266 more days of undisturbed access than a stolen human password would. That is the blast radius — not "a lot of keys" but a very large population of credentials whose compromise is structurally invisible.
Compare that to the human side of the house, where the security budget actually goes. Human identities get MFA, conditional access, impossible-travel alerts, session recording, quarterly access reviews, and an offboarding process tied to HR. Machine identities typically get created during a sprint, hardcoded into a config, and never touched again. The organization spends most of its identity money defending the smaller, better-instrumented, faster-detected population.
Chart: Average time-to-discovery for compromised credentials, human vs. machine, per IBM's 2024 Cost of a Data Breach Report.
The skeptic's pushback here is fair and worth naming: machine identities are usually scoped narrowly, so a leaked key to a single logging service is not the same as a domain admin account. True. But narrow scope only helps if someone actually scoped it — and NIST Special Publication 800-204C, which covers DevSecOps practices, identifies machine identity management as a critical gap and reports federal agencies averaging 300-plus unmanaged service accounts per application. Unmanaged accounts are the ones nobody scoped down. The narrow-scope defense assumes the very hygiene the data says is missing.
Where the Sources Disagree — and Why It Matters
The research community agrees machine identities are under-managed. It does not agree on how they get compromised, and the disagreement changes which control you should buy first.
CyberArk's 2024 Identity Security Threat Landscape Report found that 93% of organizations experienced identity-related breaches, with machine identities serving as a major attack vector, and frames the problem primarily as credential theft — an attacker takes something that was legitimately issued. GitGuardian's 2024 State of Secrets Sprawl report points somewhere else entirely: it detected over 10 million secrets, including API keys and tokens, exposed in public GitHub repositories in 2023, a 67% year-over-year increase. In that telling, nobody has to steal anything. A developer pushes a commit, and the key is simply sitting in public.
Verizon's 2024 DBIR sits between the two, reporting that stolen credentials and API abuse accounted for nearly half of breaches involving web applications.
Our read: the divergence is not a contradiction, it is a sequencing question. Accidental exposure is cheaper to fix and cheaper to attack, which means it is where a rational adversary starts. Secret scanning across repositories and CI/CD (the automated build-and-deploy pipeline) is a smaller project than a full privileged access management rollout, and it addresses GitGuardian's threat model directly. CyberArk's vault-and-rotate model matters more once the obvious leaks are closed. Organizations that reverse this order spend eighteen months on a platform deployment while their keys stay in a public repo.
The incident record backs the sequencing. Major 2024 breaches including CircleCI, the LastPass follow-up incidents, and Toyota's source code exposure all traced back to compromised machine credentials and API keys. And Gartner's prediction that by 2025, 75% of security failures would result from inadequate management of identities, access, and privileges reads less like a forecast now and more like a description.
Photo by Rahul Mishra on Unsplash
The AI Multiplier Nobody Budgeted For
AI is where this stops being a maintenance problem and becomes a growth problem. Machine learning systems depend on machine identities for API access to training data, model deployment pipelines, and inference endpoints. Every autonomous agent an organization deploys needs its own credentials and permissions — so agent adoption is, mechanically, machine identity growth. The 45:1 ratio was measured before most enterprises had agents in production.
There is a second-order effect too. GenAI coding assistants increase the odds that a developer embeds a secret in source code, because generated boilerplate frequently includes a placeholder credential that someone then fills in and commits. The tool that speeds up development also speeds up secrets sprawl. Vendors are responding — Palo Alto Networks has positioned its Idira platform explicitly around governing both human and "agentic" workforces — but tooling announcements arrive after the identities do. As AI Agents at Black Hat USA noted about vendor floor demos, the gap between what is shown and what is shipping is where the risk lives.
CISA has taken the point seriously enough to add inadequate identity and access management for non-human accounts to its 2024 Secure by Design principles, urging software manufacturers to build machine identity lifecycle management into products rather than leaving it to customers.
The Defense Stack
Three layers, in the order they actually pay off.
Technical control: automated secret scanning on every repository and every CI/CD pipeline, with pre-commit hooks that block a push containing a credential pattern. This is the layer that addresses GitGuardian's ten-million-secrets finding, and it is the cheapest thing on this list. Behind it: short-lived, automatically rotated credentials instead of static keys. A key that expires in an hour cannot sit undetected for 287 days.
Process: every machine identity gets a named human owner and an expiry date at creation. No owner, no issuance. This sounds bureaucratic and is — but it is the only mechanism that converts an orphaned credential into somebody's problem. Tie NHI decommissioning to the same change process that decommissions the service it belongs to, because the credential outliving the application is the single most common source of orphaned access.
People: security awareness training for developers that covers secrets handling specifically, not generic phishing modules. Most developers who commit a key know it is wrong in the abstract and do it anyway under deadline pressure. Make the secure path — a vault reference, an environment variable, a workload identity — faster than the insecure one, and the behavior follows. This is where cybersecurity best practices meet actual engineering velocity, and where most programs lose.
Threat intelligence feeds and incident response runbooks should both be updated to treat a leaked credential as an active incident with a defined containment path, not a ticket. Data protection reviews that only cover human access are, on these numbers, covering the minority of the attack surface.
Harden This Today
Turn on secret scanning across your source control. Not a program, not a platform evaluation — the setting. GitHub, GitLab, and Bitbucket all ship native secret detection, and enabling it across an organization is typically a single administrative toggle plus a policy that blocks pushes on detection.
Then take the first thirty findings and rotate those credentials. Not all of them. Thirty. A partial rotation completed this week beats a complete inventory that is still in planning next quarter.
Bottom line: on balance, the 287-day detection window is a more actionable number than the 45:1 ratio, because it tells you what to optimize for. The goal is not to have fewer machine identities — cloud-native architecture guarantees you will have more. The goal is to shorten the life of each one until the detection gap stops mattering. Organizations that ship credential expiry will likely see their machine identity risk converge toward their human identity risk within a year or two; organizations that buy a governance platform and leave static keys in place will not.
Frequently Asked Questions
What are machine identities in cybersecurity, and how do they differ from human identities?
Machine identities — also called non-human identities or NHIs — are credentials that software uses to authenticate to other software: service accounts, API keys, OAuth tokens, SSH keys, and TLS certificates. Human identities belong to people and are typically protected by MFA, conditional access, and an offboarding process tied to HR. Machine identities usually have none of that. They authenticate without human interaction, which is exactly why nobody notices when someone else starts using them.
Why are API keys such a big security risk for small businesses?
An API key is a single string that grants access, often with no second factor and frequently with no expiry. If it leaks — into a public repository, a log file, a screenshot in a support ticket — anyone holding it has the same access your application does. GitGuardian's 2024 report found over 10 million secrets exposed in public GitHub repos in 2023, up 67% year over year, so the leak path is well-traveled.
How can organizations manage non-human identities without a big security budget?
Start with discovery and scanning, both of which have free or built-in options in major source control platforms. Then enforce two rules that cost nothing but discipline: every machine identity has a named owner, and every machine identity has an expiry date. Vaulting and full privileged access management are worth doing, but they are the second purchase, not the first.
What percentage of breaches involve stolen credentials?
Verizon's 2024 DBIR found that stolen credentials and API abuse accounted for nearly 50% of breaches involving web applications. Separately, CyberArk's 2024 Identity Security Threat Landscape Report found 93% of organizations experienced an identity-related breach, with machine identities as a major vector.
Explore Our Network
Disclaimer: This article is editorial commentary for informational purposes only and does not constitute professional security consulting advice. No independent product testing was conducted. Always consult with a qualified cybersecurity professional for your specific needs. Research based on publicly available sources current as of August 15, 2026.
No comments:
Post a Comment