Machines Have Keys by Kai London
In most enterprises, machine identities — service accounts, API keys, certificates, workload identities and now AI agents — vastly outnumber human users, and they are far less governed. This book sets out how to find them, own them and keep their keys under control.
What the book covers
The machine identity estate
Service accounts, tokens, certificates, workload and agent identities in one inventory.
Ownership and lifecycle
Assigning owners and managing creation, rotation and retirement.
Secrets management
Vaulting, short-lived credentials and removing hard-coded secrets.
Least privilege for machines
Right-sizing permissions for automation and workloads.
AI agents as identities
Authority, delegation and accountability when software acts on its own.
Detection and response
Spotting misuse of machine credentials and responding fast.
This book offers general guidance and is not legal advice. It is independent and carries no endorsement by or affiliation with any regulator or standards body.
Who it is for
CISOs, IAM and platform engineering leads, cloud security architects and auditors responsible for identity governance.
About the author
Professor Kai London — CISSP, CISM.
An internationally recognised cybersecurity executive, board advisor and Founder & CEO of Quantum AI Systems Security LLC, writing at the convergence of AI, governance and operational resilience. Honorary Professor and Researcher at UCL.