This is a new topic for our Leadership Compass reports. If you would like to see what Nitish has to say about machine identities, you can read his Advisory Note on this topic from January by clicking here.
Inclusion Criteria
Vendors must offer a dedicated solution that addresses the lifecycle, governance, and security of non-human identities such as workloads, containers, bots, APIs, service accounts, and devices. Core inclusion requirements include support for secret management, non-human identity lifecycle automation (including provisioning, rotation, and deprovisioning), and the discovery of unmanaged or shadow identities. Vendors must demonstrate policy-based access control tailored to machine actors and offer integrations with DevOps ecosystems and CI/CD pipelines.
Additionally, eligible solutions must provide audit logging and compliance reporting relevant to NHIM, enable deployment in multi-cloud or hybrid environments, and support credential automation and behavioural analytics. Tools should provide developer-friendly APIs or SDKs and show evidence of enterprise-grade scalability and usage in production environments.
Vendors must also differentiate from traditional IAM, PAM, or IGA platforms by offering explicit capabilities for NHIs. Ultimately, inclusion is limited to vendors delivering purpose-built or deeply integrated capabilities that reflect the growing complexity, scale, and security requirements of managing non-human entities.
Exclusion Criteria
Vendors are excluded if they focus only on human IAM, lack NHI lifecycle and governance features, or offer basic secrets management without behavioural monitoring or non-human identity-specific capabilities.
However, there are no further exclusion criteria such as revenue or number of customers. We cover vendors from all regions, from start-ups to large companies.
