Zero Trust ends where your machine-identity inventory ends

Most Zero Trust implementations have a blind spot. Not in the technology. In the inventory.

Machine identities (service accounts, API keys, bot tokens, CI/CD credentials) outnumber human identities in most enterprise environments by as much as 6 to 1. Almost none of them have a named owner. No expiry date. No review cycle. No accountability.

Human identities get monthly audits, quarterly reviews and named custodians. Machine identities get created for a project, given broad permissions to make the integration work, and then forgotten. I’ve seen credentials unrotated for three years, still active, still holding write access to production systems nobody remembered to audit.

That’s not a technology gap. That’s a governance gap.

Zero Trust is built on continuous verification, but you cannot verify what you cannot see. So the question most security teams haven’t answered yet is: who owns your machine identities today? Not which team created them. Who is accountable for them right now.

That answer, or its absence, tells you exactly where your Zero Trust programme actually ends.