TL;DR: Non-human identities now outnumber human users by 144 to 1 and are growing 4 to 10 times faster, while fewer than 25% of organisations have formal policies for creating or decommissioning them, according to Commvault. The real governance problem is not just more machine accounts, but a machine-layer attack surface that traditional human-centric controls do not reliably see.
At a glance
What this is: This is Commvault’s analysis of NHI identity debt, showing that machine-layer credentials now create a larger and less governed attack surface than human accounts.
Why it matters: It matters because IAM, PAM, and NHI programmes must govern service accounts, tokens, and OAuth access as first-class identities rather than treating them as technical by-products.
Context
NHI identity debt is the accumulation of service accounts, API keys, tokens, and other machine credentials that were created faster than they were governed. In practice, that means access exists without clear ownership, lifecycle rules, or a reliable rollback path when it is abused.
The security gap is not only scale but mismatch. Human-centric controls such as MFA prompts, phishing awareness, and login anomaly detection do not reliably govern machine-layer access, where credentials can persist, move, and compound without the signals defenders expect.
Commvault’s article argues that voice phishing is increasingly the human entry point into a machine identity problem. The starting conditions described here are no longer unusual for cloud-first enterprises, they are becoming the default failure mode.
Key questions
Q: What breaks when voice phishing reaches machine identities?
A: The failure is that human recovery actions can authenticate the attacker into machine-layer credentials, after which passwords and MFA no longer help. Once the attacker controls service accounts or tokens, the compromise can persist inside cloud and SaaS workflows even if the original user account is reset or remediated.
Q: Why do long-lived service accounts increase the impact of vishing?
A: They turn a short human compromise into durable machine access. If a phish or help desk reset exposes a token, API key, or service account with broad permissions, the attacker can keep operating long after the initial user session ends, often without the login signals defenders expect.
Q: What are the signs that NHI identity debt is becoming dangerous?
A: Watch for undocumented service accounts, credentials that have no named owner, tokens that survive project closure, and machine identities with permissions broader than the workload requires. Those conditions show that access is accumulating faster than lifecycle governance can retire it.
Q: How should IAM teams respond when a machine credential is abused?
A: They should revoke the credential, trace every dependent integration, and reset any linked privileges or trust relationships before the attacker can re-establish persistence. The response has to treat the credential as a live access path, not just a secret to be replaced.
Technical breakdown
Why voice phishing now leads to machine-layer compromise
Voice phishing, or vishing, uses social engineering to persuade help desk staff or users to reset MFA, approve access, or reveal recovery paths. That human action is often only the entry event. Once the attacker is inside the human perimeter, the real objective is to reach credentials that are not protected by human login controls, especially OAuth tokens, service account secrets, and administrative API keys. Those credentials behave like infrastructure, not user sessions, so they can be reused silently and at scale. The threat is not the phone call itself, but the transition from human trust to machine trust.
Practical implication: monitor help desk resets and token issuance together, not as separate processes.
What identity debt looks like in NHI estates
Identity debt is the backlog of unmanaged machine identities that accumulate when automation creates access faster than governance can retire it. In the article’s framing, that includes undocumented service accounts, long-lived API keys in pipelines, and OAuth grants that remain valid after the original project or operator is gone. The debt compounds because these identities often carry excessive permissions and no clear owner. That makes them difficult to attest, revoke, or correlate to business accountability. In other words, the inventory problem is really a lifecycle problem.
Practical implication: treat orphaned and long-lived machine credentials as governance failures, not just inventory gaps.
Why standard detection tools miss NHI abuse
Standard security tooling is tuned to human behavior such as geolocation anomalies, unusual login times, or suspicious email activity. NHIs do not generate those same patterns. A compromised token can look like routine API traffic, and a service account can continue operating long after the initiating human account is remediated. This is why machine-layer compromise often survives password resets and endpoint response. The technical blind spot is that the compromised object is not a user session but an identity embedded inside infrastructure workflows and cloud integrations.
Practical implication: add identity-aware correlation for token creation, privilege change, and cross-domain activity.
Threat narrative
Attacker objective: The attacker wants durable access to machine-layer credentials that survive human account recovery and enable ongoing control of enterprise systems.
- Entry begins with voice phishing, where attackers use help desk impersonation or MFA reset pressure to compromise a human identity.
- Credential access follows when the attacker pivots from the human account to OAuth tokens, service accounts, or embedded API keys in the machine layer.
- Escalation occurs as the attacker creates or abuses administrative access that is rarely monitored, rarely rotated, and difficult to distinguish from legitimate automation.
- Impact is prolonged persistence in cloud and application systems even after the original human account has been remediated.
Breaches seen in the wild
- CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Identity debt is now an attack surface, not an administrative backlog: The article is right to frame unmanaged NHIs as accumulated risk rather than simple sprawl. Years of provisioning without decommissioning create persistent access paths that behave like latent privilege, especially in cloud and SaaS estates. Practitioners should read NHI inventory gaps as exposure to abuse, not merely missing records.
The human perimeter is being used as a delivery mechanism for machine compromise: Vishing matters here because it bypasses user-centric defenses and gives attackers a route into non-human access. Once a human account is reset or approved, the compromise often migrates into tokens and service accounts that conventional MFA cannot govern. That shifts the real control problem from authentication to identity lifecycle control.
Machine identities require recovery-first governance because prevention is no longer sufficient: Commvault’s core point is that many NHI abuses will evade preventive detection until after access is already established. That makes rollback speed, ownership mapping, and privilege reversion part of identity governance, not just incident response. The practitioner conclusion is that recovery-ready identity control is now a baseline capability.
Identity review models break when the subject is a credential, not a person: Access reviews were designed for human roles that persist long enough to be certified. That assumption fails when service accounts, tokens, and API keys are created and consumed faster than a review cycle can observe them. The implication is that governance has to move to issuance, not periodic review.
Identity blast radius is the right concept for this problem: Once a machine identity is overprivileged, the damage is not limited to one account or one workflow. It can cross cloud services, DevOps pipelines, and SaaS integrations with little human visibility. NHI programmes should be judged on how much blast radius they prevent when a single credential is abused.
From our research library:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
- Voice phishing was the most common initial infection vector in cloud intrusions in 2025 (23%) and the second most common across all intrusions (11%), according to Mandiant's M-Trends 2026.
- Read next: Ultimate Guide to NHIs — Key Challenges and Risks
What this signals
Identity debt is the governance gap that turns NHI sprawl into breach exposure: When machine credentials are created faster than they are retired, the programme stops being reactive and starts being structurally blind. That is why NHI governance has to treat ownership, rotation, and decommissioning as a single lifecycle problem.
Human-centric control assumptions no longer hold in mixed estates: MFA, phishing training, and login anomaly detection still matter, but they do not govern the token, API key, or service account that an attacker reaches after the human account is reset. Practitioners should assume the breach surface has shifted into the machine layer and design controls accordingly.
For practitioners
- Map machine identity ownership Assign a named owner to every service account, token, OAuth grant, and API key, and require that owner to be accountable for business purpose, renewal, and retirement.
- Replace static secrets with short-lived credentials Use short-lived tokens and automatic rotation for credentials that currently persist across pipelines, integrations, and admin workflows.
- Correlate help desk events with identity changes Investigate MFA resets, password resets, and support desk interactions together with new token creation or privilege changes to identify human-to-machine pivot patterns.
- Reduce overprivileged NHI access Review machine identities that carry administrative or cross-environment access and strip permissions down to the minimum required for the workload.
- Build rollback paths for identity abuse Prepare to revoke, replace, and rebind compromised machine credentials quickly so malicious changes can be returned to a known-trusted state.
Key takeaways
- NHI identity debt is a lifecycle problem that becomes an access problem when machine credentials outlive the projects and people that created them.
- The article links vishing to machine-layer compromise because attackers use the human perimeter to reach tokens, service accounts, and OAuth access.
- The control that matters most is not another human login check but faster ownership, rotation, and rollback for machine identities.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | The article centres on machine identities that remain active long after they should have been retired. |
| NHI-05 — Overprivileged NHI | Excessive permissions are described as a core driver of identity debt and breach impact. | |
| NHI-07 — Long-Lived Secrets | The article highlights static tokens and embedded keys that persist beyond their safe window. | |
| Recommendation — Audit machine identity retirement paths and remove accounts that no longer have a business owner. Reduce machine identity permissions to the minimum workload scope and remove administrative spillover. Replace long-lived machine secrets with short-lived credentials and enforced rotation. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The piece is fundamentally about who and what retains access across the identity lifecycle. |
| Recommendation — Review entitlement assignments for machine identities and remove access that exceeds task need. | ||
| CIS Controls v8 | CIS-5 — Account Management | Undocumented and poorly retired service accounts are a central governance failure in the article. |
| Recommendation — Inventory all machine accounts and enforce ownership, approval, and removal discipline. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | The article describes social engineering leading to credential theft and movement into deeper access. |
| Recommendation — Map vishing-led identity abuse to credential access and lateral movement detections. | ||
Key terms
- Identity Debt: Identity debt is the accumulation of unowned, over-permissioned, or poorly governed non-human identities that security teams cannot cleanly inventory or retire. It usually grows when experimentation outruns access governance, leaving service accounts and tokens active long after their original purpose has passed.
- Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
- Vishing: Voice phishing is a social engineering technique that uses phone calls or voice channels to persuade a target to reveal information or approve access. It succeeds by exploiting trust, urgency, and procedural shortcuts, often bypassing technical controls that would have stopped a direct login attack.
- Recovery-First Security: Recovery-first security is an operating model that assumes some attacks will get through and therefore prioritises rapid detection, identity rollback, and return to a trusted state. For NHIs, that means revoking tokens, disabling service accounts, and removing unauthorised privilege changes as part of containment.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on July 9, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org