Join our Newsletter — 33% off our NHI Course

The Non-Human & AI Identity Journal – Edition 64

Welcome to the latest edition of our Non-Human & AI Identity Journal, where we cover:

• NHI Mgmt Group at BlackHat
• Our pick from our Non-Human & AI Identity Forum
• Recent Breaches and Security Incidents
• Upcoming Events, Webinars, Industry Announcements
­

🎙 The Non-Human & AI Identity Podcast

Recorded at Black Hat this week, Mr NHI puts two security leaders in the Hot Seat for a rapid-fire round on Identity Security. As autonomous agents flood enterprise environments, the focus shifts from deployment speed to securing AI systems and managing machine identities at scale.

Howard Ting, CEO of Opal Security – view the recording here.

Diana Jovin, CMO at Teleport – view the recording here.

­

🚨 Recent NHI & Identity Security Breaches

Gravity SMTP CVE-2026-4020: A Single HTTP Request Exposed API Keys Across 100,000 WordPress Sites

Between May and June 2026, attackers exploited a critical vulnerability in the Gravity SMTP WordPress plugin, tracked as CVE-2026-4020, to harvest live API keys, OAuth tokens, and service credentials from approximately 100,000 websites using a single HTTP GET request. This vulnerability allowed unauthenticated access to sensitive credentials, highlighting the critical importance for security professionals to ensure robust permission checks and timely patching of plugins. The breach underscores the necessity for continuous monitoring and the implementation of protective measures like firewalls to mitigate automated exploitation efforts.

­

💬 NHI & AI Identity Forum

Our suggested reading for this week from our forum — with over 16,300 articles about NHIs, including Agentic AI.

Inside the 48-Hour Supply Chain Attack Spree Across npm, PyPI, and Docker Hub — GitGuardian
Agentic runtime authorisation: what IAM teams need to govern now — P0 Security
IAM hygiene and recertification backlogs: what teams need to fix — Nexis
AI agent identity risk in vendor environments: what changed? — Unosecur
Authn and authz are diverging under modern IAM pressure — Opal Security
IAM vs PAM: Key Differences You Need to Know — Arcon
Adaptive trust and conditional trust: where IAM teams are hitting limits — Clarity Security
AI agent access governance: why transformation stalls at the gate — C1.ai
Doppler alternatives: where secrets management stops and identity governance starts — Akeyless
Onboarding as code: what it means for IAM teams — Saviynt
Static credentials in banking infrastructure: what changes with certificates? — Teleport
Lockstep dual control for identity actions: what changes for IAM teams? — Scramble ID
Disconnected applications and Agentic IGA: is your IAM coverage complete? — StackBob
­

🏴 Latest Industry Announcements

C1.ai — AI agent identity risk is outpacing manual review controls
Akeyless — OpenAI Codex and secretless access: what IAM teams need to know
Saviynt — AI identity security: are your controls ready for agents and NHI?
P0 Security — Agentic workforce access controls: are your runtime policies keeping up?
Opal Security — Access comparison for outlier access: is continuous review enough?
Linx Security — Agentic AI access control in Snowflake: are your controls ready?
Commvault — AI agent sprawl and recovery gaps: what governance teams miss
PlainID — Real-time authorization at sign-in: what changes for IAM teams?
­

📅 Upcoming Events & Webinars

Conference

SecureWorld Atlanta 2026: what runtime authorization means for NHIs

By P0 Security

Webinar

Developer endpoint secrets on November 18, 2026: what changes now?

By GitGuardian

Conference

Gartner IAM Summit 2026: what does it mean for identity teams?

By Bitwarden

Webinar

AI-driven loyalty programmes: what happens when IT queues fall behind?

By Comarch

Webinar

AI agent regulation on July 30: what should security teams prepare?

By Zenity

Conference

Kong Developer Summit 2026 in Los Angeles: what IAM teams should watch

By Kong

Webinar

Trust infrastructure on February 23, 2027: what IAM teams need now

By Keyfactor

Webinar

AI token usage and governance gaps: what should teams do now?

By 1Password

Webinar

Phishing at scale for mid-market firms: what changes for defence?

By Abnormal AI

 
­

🎓 Training & Certification

Our CPD Certified NHI Foundation Level course delivers practical guidance on governing, managing, and securing NHIs, including AI agents. Developed by Mr NHI, it’s designed for beginners, security professionals, and IT leaders, with hundreds of learners and an average 5-star rating.

Enrol here

­

📅 Are you planning a NHI Program in 2026 including Agentic AI?

As the premier authority on Non-Human Identities, with over 20 years of hands-on experience managing $10M–$20M+ global NHI programs, we offer independent guidance and advice tailored to your needs. Our expertise spans risk and maturity assessments, program initiation and hands-on execution, ensuring your organisation stays ahead of evolving threats and maximises risk reduction. Book below for a free initial consultation.

Book here

­

Lalit Choda
Founder of the NHI Mgmt Group

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.