TL;DR: Cisco’s intent to acquire Astrix Security signals that governance for API keys, service accounts and OAuth tokens is moving into broader platform security as AI agents expand the same credential surface, according to Astrix Security. NHI control is now a platform design problem, not a niche inventory exercise.
At a glance
What this is: This is an acquisition announcement arguing that NHI governance is shifting from a specialist capability into a broader security platform concern as agentic systems increase reliance on the same credentials.
Why it matters: It matters because IAM, PAM and security teams will need to reassess how discovery, governance and detection are handled when service accounts, API keys and AI agents share the same operational footprint.
Context
Cisco’s intent to acquire Astrix Security is best read as a market signal about non-human identity governance, not as a product story. The core issue is straightforward: API keys, service accounts and OAuth tokens now underpin critical enterprise workflows, and those identities often sit outside the governance discipline applied to human access.
The article frames agentic AI as an accelerant rather than a separate problem. As AI agents inherit the same credentials and access paths used by workloads and integrations, the control plane for NHI discovery, policy enforcement and threat detection becomes part of wider identity architecture.
For IAM, IGA and PAM teams, the practical question is no longer whether NHI governance matters. It is how quickly current programmes can absorb machine and agentic identities into the same lifecycle and risk model without losing operational visibility.
Key questions
Q: What breaks when non-human identity ownership is unclear?
A: When ownership is unclear, rotation stalls, reviews default to approval, and nobody feels safe removing access. That creates orphaned identities, stale credentials, and broad permissions that persist because the organisation cannot prove what depends on them. The result is a growing attack surface with no accountable decision-maker.
Q: What problem does ownership attribution solve for service accounts and API keys?
A: It closes the gap between exposure detection and accountable remediation. Many organisations can find the secret, but not the human who introduced it, maintains it, or can safely replace it. Ownership attribution gives security teams a practical way to assign action without relying on informal knowledge that disappears during staff changes.
Q: How do organisations know whether NHI governance is actually working?
A: They should look for proof that every non-human identity has an owner, a purpose, a scope limit, a rotation rule, and a defined offboarding path. If any of those are missing, governance is incomplete even if tools are in place. Strong programmes show fewer dormant credentials, fewer broad roles, and faster revocation when incidents occur.
Q: How should security teams authenticate AI agents in enterprise environments?
A: Use the strongest method the environment can support while keeping access short-lived and scoped. For federated and cross-system access, OAuth 2.1 with OIDC is usually the default. For trusted cloud runtimes, workload identity is often cleaner. For service-to-service traffic, mTLS can work well if certificate automation and revocation are mature.
How it works in practice
Why non-human identity sprawl becomes a control problem
Non-human identities are not just another inventory category. They include service accounts, API keys, OAuth tokens, certificates and workload credentials that authenticate systems rather than people. The technical problem is that these identities are created fast, used widely and often persist far longer than the business process that needed them. When they are unmanaged, security teams lose the ability to answer basic questions about ownership, scope and revocation. That is why NHI governance sits at the intersection of identity discovery, entitlement control and secret lifecycle management.
Practical implication: build authoritative discovery and ownership records for every NHI before trying to optimise policy or rotation.
How agentic AI changes the NHI governance surface
Agentic systems do not create a new identity primitive, but they expand the set of actors consuming credentials and making runtime access decisions. An AI agent may call tools, request tokens and trigger downstream actions through the same service credentials that already govern workloads. That means the identity boundary becomes more dynamic, because access can be acquired, used and discarded within a short execution window. Governance now has to account for runtime intent, not only static entitlement assignment.
Practical implication: treat agentic workflows as credential consumers that need explicit lifecycle, scope and monitoring rules.
Provisioning to decommissioning is the real control chain
Astrix Security’s own framing emphasises the full lifecycle, from provisioning to decommissioning, which is where most NHI risk concentrates. Discovery without offboarding still leaves dormant access in place. Policy enforcement without runtime detection still misses misuse after issuance. Real-time threat detection without accurate ownership still produces alerts that nobody can act on. The control chain only holds when governance follows the identity through its entire life, not just at creation time.
Practical implication: align NHI controls to the full lifecycle, with explicit offboarding and revocation checkpoints tied to business ownership.
NHI Mgmt Group analysis
NHI governance has moved from specialty control to platform architecture. When service accounts, API keys and OAuth tokens sit inside the same business workflows that AI agents now consume, governance can no longer live in a niche inventory process. The acquisition signals that discovery, policy and detection for non-human identities are becoming table stakes in broader security platforms. Practitioners should treat NHI governance as an architectural layer, not a standalone project.
Identity blast radius is now a shared concern across workloads and agents. The article makes clear that the same credentials power modern enterprise systems and emerging agentic systems. That overlap means one weak control can expose both machine-to-machine integrations and autonomous tool use. Security teams need to think in terms of credential blast radius, not just individual secret hygiene.
Provisioning without decommissioning creates governance debt. Astrix’s own lifecycle language points to the real failure mode: identities are issued quickly, but their retirement is rarely governed with equal discipline. That gap matters more as the number of non-human identities grows and the business forgets who owns what. The implication is that lifecycle governance must be enforced as a control chain, not documented as a process.
Agentic adoption validates the original NHI problem rather than replacing it. The rise of AI agents does not change the underlying identity risk model so much as expose its weaknesses faster. Agents inherit the same trust assumptions built for service accounts, making unmanaged credentials a broader enterprise problem. The practical conclusion is that NHI programmes and agentic AI governance now converge on the same access discipline.
Credential governance will increasingly be judged by operational reach, not policy intent. A control set that cannot span discovery, enforcement and detection across Cisco Identity Intelligence, Secure Access, Duo and Splunk style layers will be too fragmented for the environments practitioners actually run. The field is moving toward integrated governance over dispersed identity touchpoints, and teams should benchmark themselves accordingly.
From our research library:
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to the Ultimate Guide to NHIs.
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
- Read next: Ultimate Guide to NHIs — Key Challenges and Risks
What this signals
Identity blast radius: the useful unit of analysis is no longer a single credential but the full set of systems it can reach. When non-human identities are shared across automation, integrations and emerging agentic workflows, the security question becomes how far one credential can travel before it is revoked or rotated.
NHI governance teams should expect tighter coupling between identity intelligence, access review and threat detection. The control problem is shifting from static account management to runtime accountability for credentials that may be consumed by services and agents across multiple environments.
For practitioners
- Inventory every non-human identity class Map service accounts, API keys, OAuth tokens, certificates and workload credentials to business owners, environments and systems of use.
- Tie agentic workflows to explicit credential ownership Record which AI agent or workflow consumes each credential, what tools it may call and who can revoke it when the task changes.
- Separate discovery from entitlement approval Do not let visibility into NHI sprawl substitute for governance. Discovery should feed ownership, scoping and review decisions, not end them.
- Enforce lifecycle offboarding for machine credentials Require a documented decommissioning step for every NHI so stale credentials do not remain usable after the integration or agent has changed.
- Correlate NHI activity across security stacks Use identity intelligence, access logs and threat detection together so abnormal credential use is visible across cloud, endpoint and SIEM layers.
Key takeaways
- Non-human identities now sit on the critical path for enterprise access, so weak lifecycle governance becomes a direct security issue rather than an administrative one.
- The article’s core message is that AI agents amplify an existing credential problem instead of replacing it, which expands the operational reach of NHI controls.
- Practitioners should focus on ownership, lifecycle offboarding and runtime monitoring if they want NHI governance to work at platform scale.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-03 — Vulnerable Third-Party NHI | The acquisition centres on governance for third-party and integrated non-human identities across platforms. |
| NHI-05 — Overprivileged NHI | The article’s risk story depends on credentials and agents holding broader access than they need. | |
| NHI-07 — Long-Lived Secrets | The post highlights persistent credentials that remain active across provisioning and decommissioning gaps. | |
| Recommendation — Map third-party NHI relationships and verify ownership, scope and revocation paths across all integrations. Review NHI entitlements for excess privilege and reduce access to the smallest operational scope. Shorten credential lifetime and remove secrets that outlive the workflow they were created for. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is fundamentally about governing who and what can access enterprise systems. |
| Recommendation — Apply PR.AA-05 to control NHI permissions, reviews and revocation across the environment. | ||
| MITRE ATT&CK | TA0006; TA0008 — Credential Access; Lateral Movement | The threat pattern centres on abuse of non-human credentials to move through connected systems. |
| Recommendation — Track credential access and lateral movement paths that start with service or agent identities. | ||
Key terms
- Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
- Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
- Agentic Identity: An agentic identity is a non-human identity used by an autonomous system that can act, call tools, and access data with execution authority. It needs the same governance discipline as other privileged identities, plus runtime context, ownership mapping, and revocation paths.
- Credential Lifecycle: Credential lifecycle is the process of issuing, rotating, expiring, and revoking secrets, certificates, and tokens across their usable life. For non-human identities, lifecycle discipline is the core control that separates temporary access from persistent exposure.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on May 14, 2026.
Updated on October 6, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org