Building the business case for an NHI programme

Why the usual case fails

The standard structure is: machine identities outnumber humans by a large multiple, they caused several major breaches, therefore fund a programme. It fails for three reasons.

The multiplier is somebody else's statistic. Ratios of machine to human identities circulate widely and originate with vendors, published without methodology. A CFO who has seen one marketing claim discounts the next. Cite it with its source and its limitation, or leave it out.

Avoided loss is two estimates multiplied. Probability of incident times cost of incident. Both are contestable, and multiplying two contested numbers produces a number nobody defends. It also invites the reply that the incident has not happened.

It competes on the wrong axis. Against a revenue project, a risk project loses unless it attaches to something already committed. The winning move is to stop competing on risk.

Four framings that get funded

1. A blocked deal. A customer questionnaire, a procurement review or a vendor assessment is holding revenue that has already been earned. This converts the request into a revenue-unblocking cost with a named deal behind it, which is a different budget conversation entirely. It is also the fastest one to verify.
2. An audit finding. An access review that excludes machine accounts, or an inability to evidence deprovisioning, is a finding with a remediation date attached. Findings have owners and deadlines. Use the one you already have rather than forecasting one you might get. See ISO 27001 and SOC 2.
3. An obligation with a date. Not a general regulatory posture. A specific date: 100-day certificates in March 2027, 47 days in March 2029, Annex III high-risk obligations on 2 December 2027, Article 50(2) marking on 2 December 2026. Dates create sequencing pressure that risk arguments cannot.
4. A cost already being paid. Engineering hours spent on manual rotation, credential-related incident response, and outages from expired certificates. This is the strongest framing when it applies, because you are proposing to redirect spend rather than create it, and the finance function can verify it from existing records.

Four numbers to gather first

All four are obtainable in days without buying anything, and none is an estimate.

1. Inventory coverage, with the method stated. "We can account for 62% of non-human identities, measured 12 August, by reconciling issuer enumeration against our register."
2. Credentials with no expiry, as an absolute count, with the production-reaching subset called out separately. This number tends to be larger than leadership expects and does most of the persuasive work.
3. Authority ratio on the highest-risk tier. Permissions granted against permissions exercised over ninety days.
4. Measured revocation time. Run the drill and record the number. "Four hours and ten minutes, measured 14 August" ends a conversation that "we would revoke it" does not.

The rhetorical value is that each is a measurement rather than a claim. A budget holder can dispute a forecast. Disputing a measurement requires disputing the method, which moves the conversation onto ground you control. See metrics and board reporting.

Writing the ask

One page. Five parts.

1. The trigger. One of the four framings, in a sentence, with the specific deal, finding or date named.
2. The four numbers, with measurement dates and methods.
3. A scoped first phase with an outcome, not a headcount. "Every production-reaching credential inventoried, owned and expiry-bounded by 31 December" is fundable. "Two engineers for six months" invites a negotiation about headcount.
4. What you will not do, and why. Naming the deferrals makes the ask look considered and pre-empts the question about whether this is the thin end of a wedge.
5. How you will report. The same four numbers, at a stated cadence, so the funder can tell whether it worked.

Resist asking for the whole programme. A funded first phase that reports credible numbers is the strongest possible position from which to ask for the second, and it converts an argument about belief into an argument about evidence.

Three objections, and answers that work

"Can't the existing IAM team absorb this?" Partly, and the parts that do not absorb are the ones that matter. Human IAM is triggered by HR events that non-human identities do not generate, and the scale is one to two orders of magnitude larger. Access review concepts transfer; the lifecycle trigger model does not. See NHI versus IGA, PAM and ITDR.

"Doesn't our PAM cover it?" For privileged service accounts, well. Not for SaaS OAuth grants, CI/CD tokens, cloud workload identities or agent credentials, none of which are sessions. The concrete answer is your own number: how many identities in your inventory are outside PAM scope.

"Nothing has gone wrong, so why now?" The honest answer is a date, not a scare. Certificate lifetimes are contracting on a published schedule, a regulatory obligation has a fixed application date, or a customer questionnaire is in flight. If none of those is true for you, the honest answer may be that a full programme is not yet warranted, and proposing a smaller measurement exercise instead will earn more credibility than overstating the case.

Frequently asked questions

How do you justify budget for a non-human identity programme?

Attach it to something already committed rather than to avoided loss. Four framings work: a blocked deal where a customer questionnaire is holding earned revenue, an existing audit finding with a remediation date, a specific regulatory or technical date such as certificate lifetime reductions, or a cost already being paid in manual rotation and credential incident response. Use the one that is actually true rather than assembling several.

Why do avoided-loss models fail for security budget requests?

Because they multiply two contestable estimates, probability of incident and cost of incident, and produce a number nobody in the room will defend. They also invite the reply that the incident has not happened. Measured numbers work better, because disputing a measurement requires disputing the method, which is ground you control.

What numbers should you gather before writing a business case?

Four, all obtainable in days without buying anything: inventory coverage with the measurement method stated, the absolute count of credentials with no expiry with the production-reaching subset separated, the authority ratio of permissions granted against exercised on the highest-risk tier, and a measured revocation time from an actual drill. Each is a measurement rather than a claim, which is what makes them hard to argue with.

Should you ask for the whole programme or a first phase?

A scoped first phase with an outcome rather than a headcount. Every production-reaching credential inventoried, owned and expiry-bounded by a named date is fundable; two engineers for six months invites a negotiation about headcount. A funded first phase that reports credible numbers is also the strongest position from which to ask for the second.

How do you answer the objection that nothing has gone wrong yet?

With a date rather than a scare. Certificate lifetimes contract on a published schedule to 100 days in March 2027 and 47 days in March 2029, and regulatory obligations have fixed application dates. If no date and no commitment applies to your organisation, the honest answer may be that a full programme is not yet warranted, and proposing a smaller measurement exercise will earn more credibility than overstating the case.