Non-human identity and secrets governance has become a crowded category, and the buying process has not caught up. Most evaluation frameworks still borrow from endpoint or SIEM procurement: feature matrices, deployment options, analyst positioning. Those criteria describe whether a product can be operated. They say very little about whether it will reduce the number of unmanaged credentials an organisation actually carries, which is the only outcome that matters.
The problem is that NHI risk is not evenly distributed. A small number of identities hold disproportionate access, and a large number hold credentials nobody remembers issuing. Tooling that produces a comprehensive inventory without a path to remediation simply relocates the anxiety. Security teams end up with a dashboard showing forty thousand machine identities, no owner attribution, and no defensible answer to what should be decommissioned first.
Evaluation criteria that separate platforms
Discovery breadth, not discovery count. Ask where the platform can see credentials: cloud control planes, Kubernetes, CI/CD pipelines, code repositories, SaaS integrations, on-premises directories, and workload runtime. A tool that covers four of seven categories will report a clean estate and be wrong.
Ownership resolution. Every discovered identity should resolve to a team, an application, or a business owner. Platforms that cannot attribute ownership push the entire remediation burden onto a central team that does not have the context to act.
Lifecycle enforcement. Inventory is observation; rotation, revocation, and expiry are control. Evaluate how the platform issues and rotates secrets, whether it can enforce maximum credential age, and what happens to an identity whose owner no longer exists.
Questions vendors will not volunteer
How is the platform’s own access governed? A tool that requires broad, long-lived credentials across every cloud account becomes the highest-value target in the estate it is protecting. Ask for the platform’s permission model, its break-glass process, and whether its own service identity is scoped and rotated like the ones it manages.
What happens on day one hundred? Detection at onboarding is easy to demonstrate. The harder test is drift: an identity granted new permissions last month, a secret that has not rotated since deployment, an integration that was decommissioned at the vendor but still holds a valid token. Ask for evidence of continuous reconciliation rather than point-in-time discovery.
Can it express machine identity in terms the business recognises? Agentic workloads require auditability that maps an action to a human accountable for it. Platforms that surface only technical attributes will not survive a risk committee review, and will not support the access reviews regulators increasingly expect.
Procurement as governance
The strongest signal in an evaluation is not the demonstration but the remediation backlog the platform creates in the first thirty days. A credible deployment should produce a prioritised list of identities to remove, a set of credentials to rotate, and named owners for both. Secret storage without lifecycle control, and discovery without attribution, are the two failure modes worth screening out before a contract is signed.