Best practices for non-human identity security in modern stacks

At a glance

What this is: This is an analysis of best practices for non-human identity security, arguing that blind trust, over-privilege, and weak lifecycle governance are the main gaps in modern stacks.

Why it matters: It matters because IAM and security teams need controls that treat NHIs, workloads, and AI agents as governed identities with scoped access, auditability, and ownership.

By the numbers:

• 50% of surveyed organizations had a breach in the past year tied to compromised machine identities, most often through poorly scoped API keys, SSL/TLS certificates, and service account tokens.

Context

Non-human identity security is the discipline of governing machine and agent access with the same lifecycle rigor used for people, but adapted for code, services, and workloads. Cerbos argues that the common failure is not lack of automation, but over-trust: teams often know how to secure employees while leaving NHIs with broad access, poor visibility, and weak accountability.

The article frames the problem through a modern stack where services, OAuth apps, CI/CD secrets, and AI agents all operate across domains with different risk profiles. That spread makes exposure mapping, scoped authorization, and lifecycle ownership foundational rather than optional, especially when teams cannot say with confidence what their services are doing on behalf of users.

Key questions

Q: How should security teams find hidden non-human identities in cloud and application estates?

A: Start by correlating cloud inventories, CI/CD variables, secret stores, workload logs, and identity governance records. The goal is to map every token, certificate, and service account to a workload and owner. If an identity cannot be tied to a business function, treat it as unmanaged exposure rather than a benign artifact.

Q: Why do overprivileged machine identities increase risk so quickly?

A: Because machine identities can operate at scale, a single broad credential can expose multiple services, environments, or datasets at once. The risk is not just misuse, but blast radius: once scope is too wide, one compromise or prompt injection can turn into lateral movement or data leakage.

Q: What breaks when non-human identity credentials are long-lived and poorly rotated?

A: Long-lived credentials widen the window for reuse after exposure and make it harder to prove that access is still needed. They also increase the chance that forgotten integrations, orphaned accounts, or stale tokens keep working after the business need has changed. That is why rotation and retirement have to be treated as governance controls, not housekeeping tasks.

Q: How do teams govern NHI lifecycle ownership between security, IAM, and engineering?

A: Use a shared operating model with clear accountability for issuance, policy, rotation, monitoring, and retirement. Security should define risk and audit expectations, IAM should own policy and lifecycle orchestration, and engineering should enforce runtime controls. The goal is one accountable path for every identity, not a handoff chain that leaves machine access unmanaged.

Technical breakdown

Why implicit trust breaks NHI governance

Non-human identities often start life as convenience objects: a token, service account, API key, certificate, or agent credential that is created to keep systems moving. The problem is that these identities quickly become production access paths, yet many organisations never attach the same accountability, visibility, or review discipline they apply to human accounts. In practice, that creates a trust gap between issuance and actual use. Zero Trust helps here because it assumes no identity is trusted by default and every authorization decision must be explicit, contextual, and policy-driven.

Practical implication: Treat every NHI as a governed identity from issuance onward, not as a technical shortcut that can be left on autopilot.

How scoping and lifetime control change machine risk

The article repeatedly points to scoped, short-lived credentials as the corrective pattern because machine identity risk grows when privilege is broad and durable. Long-lived access is hard to reason about in distributed systems, and it widens the blast radius when a secret leaks, an app is compromised, or an integration is forgotten. Scoping limits what an identity can do, while short-lived credentials reduce how long an attacker can reuse it. That combination is more important than simply adding more authentication steps, because machine access problems are usually authorization and lifecycle problems first.

Practical implication: Design machine access so the credential lifetime and the permission scope both shrink with the task, environment, and business need.

Why discovery, metrics, and lifecycle ownership matter together

The article’s strongest operational point is that organisations cannot govern what they cannot inventory or measure. Discovery tells you where NHIs exist, metrics tell you whether controls are improving, and lifecycle ownership tells you who is responsible for rotation, monitoring, and retirement. Without all three, organisations end up with orphaned service accounts, unused secrets, and stale integrations that survive long after the business need has changed. That is why NHI governance has to span creation, use, rotation, and decommissioning rather than stopping at policy writing.

Practical implication: Build an inventory with owners and measurable hygiene signals, then use it to drive offboarding and rotation decisions.

Threat narrative

Attacker objective: The attacker objective is to turn routine machine access into durable, high-blast-radius access that can expose data or control workloads.

1. Entry begins with overly trusted non-human identities such as service accounts, OAuth apps, or AI agent credentials that already have access inside the environment.
2. Credential abuse follows when scoped keys, certificates, or tokens are poorly governed, overly broad, or long-lived enough to be reused after exposure.
3. Escalation occurs as the compromised identity reaches data, workloads, or APIs beyond its intended function because authorization boundaries were never tightened.
4. Impact comes from unauthorized access, data exposure, or remote execution paths that persist until the identity is discovered and revoked.

Breaches seen in the wild

• AI agent retail card theft campaign 2026: AI agents breached 27+ retailers for about $25 each, used cloud keys and a Secrets Manager dump, and stole 600,000+ payment cards.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Blind trust in non-human identities is now a governance failure, not a configuration oversight. The article shows that many organisations still secure employees more carefully than services, workloads, and agents, even though the latter often touch the same systems and data. That mismatch breaks the basic identity assumption that access should be justified, scoped, and reviewable for every actor type. Practitioners should treat NHI trust posture as a core governance issue, not a side effect of infrastructure scale.

Ephemeral credential trust debt is the named problem emerging from modern stack sprawl. NHIs are easy to create, easy to spread, and difficult to retire, so each unmanaged credential adds hidden future risk. The article’s emphasis on short-lived, scoped access makes the point clearly: the longer a machine credential persists, the more governance debt accumulates around it. Practitioners should measure that debt explicitly through rotation age, orphaned access, and scope drift.

The article correctly reframes NHI security as lifecycle governance, not just secret storage. Inventory, ownership, rotation, monitoring, and retirement are presented as one connected operating model, which is the right framing for NHIs. That matters because security teams often focus on vaulting or access control in isolation and miss the operational handoff that makes identities linger after their purpose ends. Practitioners should govern machine identities end to end, not in disconnected tool silos.

Machine identity programmes fail when IAM is treated as human-only work. The article surfaces a real leadership gap: security and engineering end up owning machine identities because traditional IAM operating models were built around employees and customers. That creates inconsistent enforcement across service, DevOps, and application teams. Practitioners should explicitly assign machine identity ownership to the teams that can enforce issuance, scope, rotation, and retirement.

Zero Trust is relevant here because it removes the assumption that NHI access is inherently safe once issued. The article’s strategy depends on centralized, policy-driven decisions rather than implicit trust in the caller. That aligns with NIST SP 800-207 and with the practical reality that machine access changes quickly across environments. Practitioners should use Zero Trust as the architecture principle that keeps NHI controls from becoming static exceptions.

From our research library:

• 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
• NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
• Read next: Ultimate Guide to NHIs

What this signals

Ephemeral credential trust debt: When NHIs are created faster than they are reviewed, the real problem is not secret volume alone but the accumulation of access that outlives its original purpose. Teams should expect stale tokens, forgotten service accounts, and orphaned integrations to become a recurring governance issue unless lifecycle controls are built into the operating model.

The practical shift is from vault-centric thinking to identity-centric thinking. If the organisation cannot tie each machine credential to an owner, a scope, and a retirement path, then rotation and policy enforcement will always arrive too late to fully reduce risk.

For practitioners

• Map every non-human identity Build a complete inventory of service accounts, OAuth apps, CI/CD secrets, certificates, and agent credentials, and attach owners and business purpose to each one.
• Replace broad machine privilege with scoped policy Constrain each identity to the minimum resource, action, and environment set it needs, and remove standing access that is broader than the workload requirement.
• Shorten credential lifetime everywhere possible Move high-value NHIs to short-lived credentials and enforce rotation and revocation paths for secrets, tokens, and certificates that still need persistence.
• Assign a named owner for each NHI lifecycle Make one team responsible for creation, monitoring, rotation, and retirement so stale identities do not survive after systems, vendors, or projects change.
• Track hygiene metrics as operational controls Measure orphaned accounts, time-to-revoke, rotation frequency, and scope violations so governance decisions are based on evidence rather than assumption.

Key takeaways

• Non-human identity security fails most often when organisations trust machine access by default and leave it broader than the workload requires.
• The article links this gap to real operational scale, including environments with thousands of services and workloads and widely used long-lived credentials.
• The strongest control response is to combine discovery, scoped authorization, short-lived credentials, and named ownership across the full NHI lifecycle.

Key terms

• Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
• Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.
• Credential Rotation: The practice of regularly replacing secrets and credentials with new values to limit the window of exposure if a credential is compromised. Automated rotation, enforced by policy, is the security-optimal approach.
• Zero Trust: A security model that assumes no identity, human or non-human, should be trusted by default, even inside a network perimeter. Every access request must be verified, authorised, and continuously validated.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.