Changing Backgrounds in 3D Software: A Guide

The massive scale of machine identity sprawl

Ever feel like your cloud is getting way too crowded? It’s not just you—it's the machines.

• The 144:1 Gap: According to Entro Security, non-human identities now outnumber us humans by a staggering 144 to 1.
• AI Sprawl: The rise of agentic ai and automated pipelines has caused a 44% year-over-year surge in machine identities. ([PDF] The Rise of Machine Identity: Securing Non-Human Access - HCLTech)
• The 43% Leak: Research shows that nearly 43% of secrets are actually found outside of git repositories, like in build logs or messaging apps.
• Invisible Risks: Many of these service accounts and api keys lack clear ownership, creating massive holes in your identity posture.

It's getting messy fast. Next, let’s look at the dangerous levels of access these hidden identities actually hold.

Finding secrets where they hide

You'd think secrets just live in code repos, right? Wrong. I've seen devs drop api keys into Slack just to "fix a quick bug," and suddenly your perimeter is toast. It's a mess out there.

• The 43% Trap: Like I mentioned, nearly half of exposed credentials aren't even in git. They’re rotting in CI/CD logs or Teams chats.
• Shadow access secrets: People self-service their own identities, creating "shadow access" that bypasses normal governance, according to IBM.
• Workflow leaks: Hardcoded tokens in GitHub Actions or Jenkins files often stay active for years because "it just works."

In retail or finance, one leaked token in a build log can expose a whole customer database. Since these things have no expiration date, they’re just waiting to be found.

Next, let’s look at the dangerous levels of access these hidden identities actually hold.

The risk of shadow access and super nhi

It's wild how we obsess over human admins while "Super NHIs" run loose with even more power. NHI stands for Non-Human Identity—basically any service account or bot—and a "Super NHI" is one that has full admin or over-privileged access. I've seen teams spend weeks on human MFA just to leave a single service account with full admin rights.

• The 5.5% Admin Trap: According to Entro Security, more than 1 in 20 machine identities in aws are basically "Super NHIs" with full administrator privileges by default.
• Invisible Escalation: These accounts create secret paths that bypass normal governance, often because nobody actually "owns" the lifecycle of a bot or api key.
• Governance Gaps: Without a framework like the one from nhimg.org, these long-lived credentials—some over 10 years old—just sit there waiting for an exploit.

In healthcare or finance, a "Super NHI" in a dev environment can accidentally touch production databases. Since they don't quit like humans do, they stay dangerous forever.

Next, let's talk about fixing this mess.

Implementing automated scanning workflows

So you've found a bunch of messy secrets—now what? Manually fixing thousands of api keys is a recipe for burnout and, honestly, you'll probably miss the one that actually matters.

• Pipeline integration: Stick your scanners right into the CI/CD flow. If a dev tries to push a hardcoded token, the build should just fail immediately.
• Auto-rotation: When a leak happens in a Slack channel or Jira ticket, use a tool like Akeyless to automatically rotate that credential before an attacker even sees the notification.
• Risk scoring: Use ai to prioritize. A leaked "Super NHI" key in a public repo is a "drop everything" fire, while a stale test key can wait until Monday.

I've seen retail teams save hours by just automating the "revoke and replace" cycle for their service accounts. It keeps the auditors happy and your production db safe.

Next, let's explore the best practices for securing these identities over the long term.

Best practices for long term nhi security

Look, nobody wants to manage secrets manually forever. It’s a total nightmare for security leaders. To truly fix this, we gotta move toward ephemeral tokens that just disappear after use.

• Ditch the "Forever" Keys: Convert those decade-old service accounts into short-lived access.
• jit access: Only give permissions when a workload actually needs it.
• Centralize everything: Use a unified identity fabric. This gives you the visibility you need to actually orchestrate jit access across different clouds and stop the "shadow access" mess.

In retail or finance, this stops a leaked key from being a permanent backdoor. Honestly, moving to just-in-time is how you actually sleep at night.