Service accounts and secrets proliferate with old credentials and no rotation, so the blast radius of a single leaked secret is huge and unknown. Machine identity is the ungoverned majority.
"How old are our service-account secrets, are they rotating, and what's the blast radius if one leaks?"
Stale secrets
Service-account governance view
To first outcomes