The Hidden Importance of Machine Identities in Cloud Native Security
February 05, 2024

Sitaram Iyer
Venafi

A competitive edge in today's on-demand, software-first economy can be quantified in terms of weeks, days, or even hours. Quickness prevails. In order to have a competitive edge, companies today must innovate and move fast, and in high-pressure times, security and developer teams need to work together quickly and efficiently to protect their organizations.

The field of cloud native development is rapidly evolving, but during this shift to modern environments such as Kubernetes, many DevOps teams are putting security on the back burner in a rush to move to cloud native environments. This is opening the door to a wide array of new security risks and numerous opportunities for unscrupulous cybercriminals — and machine identities are a prime example of this. The number of machine identities used by organizations has continued to increase year over year, creating an ever-growing security risk that cybercriminals are looking to exploit.

According to a 2023 Venafi survey, 84% of security and IT leaders anticipate that Kubernetes will soon be the primary platform used to construct all applications as cloud native development is becoming increasingly popular and Kubernetes has become the de facto norm. However, 75% think that the speed and complexity of cloud native development introduce new security blind spots.


The actual move to cloud native environments comes with its own set of challenges and risks, and many development teams fail to take the time to properly and safely transition their data and applications. While 87% of security and IT leaders have started to move legacy applications to the cloud, many did not optimize for cloud native. More than half (53%) simply did a lift and shift to the cloud with most application code remaining the same.

Developers are more likely to prioritize speed above security when given the option, with 68% of security and IT leaders concerned that developers may not always utilize certificates since issuing them causes additional friction in development processes. Since code signing slows down development, over half (47%) of security and IT officials acknowledge they do not require it for artifacts.

So what role does machine identity management play in the rapid corporate transition to a cloud native environment? Machine identities are the cornerstone of cloud native security since they secure all connections and facilitate authentication and authorization for workloads within and across clusters. However, if machine identities are not readily accessible throughout the development process, developers could be tempted to circumvent the proper use of machine identities by taking security shortcuts and creating workarounds. This can often lead to security teams not having the right visibility into how machine identities are fulfilled, potentially risking CA compromise especially when workloads are signed with a CA that is bootstrapped without proper controls and governance.

Among security and IT leaders, 88% believe that machine identity management is key to the success of zero trust models, but 74% of security and IT leaders worry that developers are challenged with several conflicting priorities — meaning security is not always top of mind. To address this challenge, developer teams need to work together with security teams to make security a priority. Key to this is managing all machine identities across their org — which can only be done effectively through the two teams working together.

Machine identities are paramount to securing cloud native resources and sensitive microservices that are accessible from anywhere on the Internet. Organizations must identify a wide array of cloud native machines, such as containers, microservices, DevOps artifacts, API connections, and more, to properly implement the newest technological advancements. All these networked cloud native computers need to be able to quickly authenticate themselves to one another to function securely. Balancing security and the need to keep up with the rapid pace of innovation today is critical to ensuring that organizations do not become vulnerable to a growing number of cybersecurity threats.

Sitaram Iyer is Senior Director of Cloud Native Solutions at Venafi
Share this

Industry News

May 22, 2025

Red Hat announced enhanced features to manage Red Hat Enterprise Linux.

May 22, 2025

StackHawk has taken on $12 Million in additional funding from Sapphire and Costanoa Ventures to help security teams keep up with the pace of AI-driven development.

May 21, 2025

Red Hat announced jointly-engineered, integrated and supported images for Red Hat Enterprise Linux across Amazon Web Services (AWS), Google Cloud and Microsoft Azure.

May 21, 2025

Komodor announced the integration of the Komodor platform with Internal Developer Portals (IDPs), starting with built-in support for Backstage and Port.

May 21, 2025

Operant AI announced Woodpecker, an open-source, automated red teaming engine, that will make advanced security testing accessible to organizations of all sizes.

May 21, 2025

As part of Summer '25 Edition, Shopify is rolling out new tools and features designed specifically for developers.

May 21, 2025

Lenses.io announced the release of a suite of AI agents that can radically improve developer productivity.

May 20, 2025

Google unveiled a significant wave of advancements designed to supercharge how developers build and scale AI applications – from early-stage experimentation right through to large-scale deployment.

May 20, 2025

Red Hat announced Red Hat Advanced Developer Suite, a new addition to Red Hat OpenShift, the hybrid cloud application platform powered by Kubernetes, designed to improve developer productivity and application security with enhancements to speed the adoption of Red Hat AI technologies.

May 20, 2025

Perforce Software announced Perforce Intelligence, a blueprint to embed AI across its product lines and connect its AI with platforms and tools across the DevOps lifecycle.

May 20, 2025

CloudBees announced CloudBees Unify, a strategic leap forward in how enterprises manage software delivery at scale, shifting from offering standalone DevOps tools to delivering a comprehensive, modular solution for today’s most complex, hybrid software environments.

May 20, 2025

Azul and JetBrains announced a strategic technical collaboration to enhance the runtime performance and scalability of web and server-side Kotlin applications.

May 19, 2025

Docker, Inc.® announced Docker Hardened Images (DHI), a curated catalog of security-hardened, enterprise-grade container images designed to meet today’s toughest software supply chain challenges.

May 19, 2025

GitHub announced that GitHub Copilot now includes an asynchronous coding agent, embedded directly in GitHub and accessible from VS Code—creating a powerful Agentic DevOps loop across coding environments.