Machine, Service and Workload Identity
Managing credentials for systems, not just people
Machine, service and workload identity refers to the credentials that automated systems, applications, containers and microservices use to authenticate with each other without human intervention, a type of identity that in many modern organizations already outnumbers human user identities. This matters in practice because these non-human identities usually receive much less governance attention than people's accounts, with API keys embedded directly in source code, certificates that never expire or credentials shared among dozens of services, which makes them an attractive and frequently neglected target for attackers. A concrete example is a cloud database access key accidentally exposed in a public code repository, an increasingly common incident that has allowed automated attackers to scan public repositories for leaked credentials and compromise entire infrastructures in minutes.