The 45-to-1, and up to 140-to-1, ratio of non-human to human identities is the stat that reframes the whole access problem, most orgs are securing the smallest slice. Moving from static keys to ephemeral tokens is the right instinct, though the rotation and revocation story is where I've seen it get hard. How are you tracking which NHIs are actually still in use versus abandoned and over-permissioned?