TL;DR: NHIs now outnumber human accounts by as much as 50 to 1, and attackers are increasingly using compromised human and machine credentials to move laterally into SaaS environments, according to Hydden. Existing IAM, IGA, PAM, and detection workflows were built around human account assumptions that do not hold for long-lived machine identities.
At a glance
What this is: This is an analysis of why SaaS non-human identities are outgrowing legacy IAM assumptions, with Hydden arguing that service accounts, API keys, certificates and OAuth tokens are creating sprawl and governance blind spots.
Why it matters: It matters because IAM, IGA and PAM teams have to govern machine credentials differently from employee accounts, or they will miss the access paths attackers are already using to reach SaaS environments.
By the numbers:
- Non-human identities outnumber humans as much as 50 to 1 in many environments.
Context
Non-human identity sprawl is the gap between how SaaS access now works and how most IAM programmes were designed. A non-human identity is a machine-facing credential such as a service account, API key, certificate or OAuth token that authenticates software rather than a person.
Hydden's core claim is that these identities do not fit the same lifecycle, governance and detection patterns used for human users. They are often long-lived, created outside standard onboarding, and far harder to baseline because they generate continuous rather than human-like activity.
That makes the governance problem broader than simple credential hygiene. When machine identities outgrow inventory, privilege review and decommissioning processes, the result is access sprawl that attackers can exploit inside SaaS environments.
Key questions
Q: What breaks when SaaS integrations are not governed as non-human identities?
A: Teams lose visibility into who or what can reach connected systems, and attackers can use trusted credentials to move through those integrations without triggering normal human-account controls. The practical failure is blast radius, not just access. One over-scoped token or service account can expose multiple downstream platforms, especially when ownership, rotation, and review are missing.
Q: Why do overprivileged service accounts create such persistent cloud risk?
A: Overprivileged service accounts create persistent risk because they combine standing access, weak ownership, and broad lateral movement potential. When those accounts are not tightly reviewed, an attacker or insider can move from a small foothold to broader cloud access. The issue is not only permission size, but how long that privilege remains valid.
Q: What are the signs that NHI governance is failing in an enterprise?
A: Common warning signs include unclear ownership for service accounts, secrets stored in code or configuration instead of managed vaults, infrequent rotation, and weak offboarding of API keys. Other red flags are excessive permissions, third-party exposure without controls, and low visibility into where non-human identities exist or how they are used across the stack.
Q: How do IAM and PAM teams split responsibility for AI agent access?
A: IAM should define what the agent can reach, while PAM should control when elevated access is available and how it is revoked. For AI agents, those responsibilities must be coordinated because programmatic identities do not fit a human session model. If scope and elevation are managed separately without a shared lifecycle view, privilege can persist longer than anyone expects.
Breaches seen in the wild
- Kubeflow cryptomining attacks 2020: Exposed Kubeflow dashboards and a notebook's mounted Kubernetes service account let attackers run cryptominers on tens of ML clusters.
- Dropbox Sign breach 2024: A compromised back-end service account gave attackers Dropbox Sign customer data, including API keys, OAuth tokens and MFA information.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Human-centric IAM leaves a non-human identity governance gap: The operating assumption behind most IAM programmes is that access is attached to a person, can be challenged interactively, and can be reviewed on a human lifecycle. That assumption fails when the credential is a workload or integration, because service accounts and tokens can exist outside user onboarding, MFA and conventional decommissioning. The implication is that NHI governance is not a subset of user IAM; it is a separate control plane for machine access.
Long-lived machine credentials create identity blast radius: When service accounts and API keys remain active for long periods, the question is no longer whether they exist but how far they can reach if abused. Hydden's analysis shows that overprivilege and poor inventory are what turn routine automation into an enterprise-wide exposure path. Practitioners should read this as a privilege containment problem, not just a secrets problem.
Detection models built on human behaviour are structurally weak for NHIs: Continuous machine activity does not produce the same anomaly profile as a user login, so baseline-driven detection often misses the most important credential misuse patterns. That creates a blind spot where the identity layer looks quiet even when access is highly exposed. The practical conclusion is that ownership, scope and lifecycle state must become first-class detection signals.
OWASP-NHI issues are now SaaS governance issues: The article maps directly to improper offboarding, secret leakage, insecure authentication and overprivileged NHI conditions. Those failure modes are no longer edge cases in cloud tooling; they are the everyday condition of SaaS access at scale. Security teams need to treat machine identity inventory and privilege review as core IAM work, not an adjacent specialist task.
Identity governance has to move from periodic review to continuous inventory: The article's strongest operational signal is that organisations cannot govern what they cannot enumerate. Once NHIs outnumber humans at this scale, static spreadsheets and user-led access review processes stop being credible control evidence. The practitioner takeaway is to make NHI discovery, ownership and revocation continuous rather than event-driven.
From our research library:
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to the Ultimate Guide to NHIs.
- Read next: Service Account Security Guide
What this signals
Identity sprawl is now the governance problem, not a side effect: Once machine identities outnumber humans at this scale, access review programmes built for people stop producing reliable assurance. The practical response is to move NHI governance to the front of IAM operations, with ownership and revocation treated as live controls rather than periodic paperwork.
Service account security has become the SaaS control plane: Attackers are targeting the credentials that underpin integrations and automation because they often outlast user accounts and carry broader privileges. That means SaaS governance, PAM and identity threat detection all need machine-identity signals, not just human sign-in data.
For practitioners
- Build a separate NHI inventory Establish a live register for service accounts, API keys, certificates and OAuth tokens that records owner, purpose, scope and last use. A human user directory is not enough to govern machine access.
- Recertify machine privilege against workload need Review each non-human identity for current business function, effective permissions and downstream SaaS reach. Remove inherited scopes that are no longer required by the workload.
- Replace human-centric MFA assumptions Map which machine credentials cannot support interactive approval and define alternative authentication controls such as workload-bound credentials, scoped tokens and stronger secret handling.
- Track ownership and decommissioning Tie every non-human identity to a named business owner and enforce revocation when the workload, vendor relationship or integration ends. Unowned credentials become permanent attack paths.
- Tune detection for machine activity patterns Prioritise alerts on new credential creation, scope changes, unusual SaaS access paths and stale credentials rather than relying only on human-behaviour anomalies.
Key takeaways
- Non-human identities are no longer a niche operational concern. In SaaS environments they now create the access paths that human-centric IAM controls are least prepared to govern.
- The risk concentrates in long-lived credentials, unclear ownership and overprivileged machine accounts that sit outside standard user lifecycle processes.
- Organisations need separate inventory, authentication, review and decommissioning controls for NHIs if they want governance to keep pace with SaaS sprawl.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | The article stresses that non-human identities are often not decommissioned through standard lifecycle paths. |
| NHI-05 — Overprivileged NHI | Hydden's core concern is long-lived, overly permissioned service accounts and tokens. | |
| NHI-04 — Insecure Authentication | The article notes that NHIs cannot rely on human MFA and need different authentication patterns. | |
| Recommendation — Build machine-identity offboarding into revocation workflows when workloads or integrations end. Review NHI entitlements against workload need and strip inherited privileges that no longer serve a function. Use workload-appropriate authentication patterns for machine identities instead of human MFA assumptions. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is fundamentally about governing who or what can access SaaS resources. |
| Recommendation — Align machine-identity entitlements to PR.AA-05 and review them as a separate access population. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | Hydden describes attackers using compromised accounts and machine credentials to move through SaaS environments. |
| Recommendation — Map SaaS credential abuse to TA0006 and TA0008 to prioritise detection and containment paths. | ||
Key terms
- Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
- Service Account: A special-purpose account used by applications, automated tools, or services rather than a human user to interact with systems, APIs, and infrastructure. Service accounts are a primary category of NHI and one of the most frequently exploited attack vectors.
- Identity Sprawl: Identity sprawl is the uncontrolled growth of identities, entitlements, and credentials across an environment. For NHIs, it usually appears when automation creates accounts faster than governance teams can inventory, review, and remove them. The result is hidden access, weak accountability, and a wider attack surface.
- Workload-bound Credential: A workload-bound credential is issued for one process or service and is only valid in that execution context. This reduces replay risk because copied credentials are less useful outside the workload that obtained them, especially in CI and supply-chain-heavy environments.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 23, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org