TL;DR: Non-human identities now outnumber human identities by 45:1 in the source article’s framing, and traditional IAM tools struggle with their dynamic, machine-to-machine access patterns, according to Aembit. The governance problem is no longer visibility alone; it is continuous control over lifecycle, privilege, and policy enforcement across automated systems.
At a glance
What this is: This is an analysis of why non-human identity governance is becoming harder than human IAM, with Aembit arguing that dynamic workload, API, and agent access outgrows traditional controls.
Why it matters: IAM, PAM, and security teams need to treat service accounts, APIs, and AI-adjacent workloads as first-class identities because their speed, scale, and lifecycle patterns change how access must be governed.
Context
Non-human identity governance is the problem space here: service accounts, application credentials, APIs, microservices, and AI-adjacent workloads now operate at a scale and speed that human IAM processes were never designed to handle. The governance gap is not simply about inventorying more accounts. It is about controlling access when identities are created, chained, rotated, and retired by machines rather than people.
Aembit’s article frames this shift through cloud computing, DevSecOps, API-driven architectures, automation, and agentic AI. Those drivers make identity state more fluid, which means entitlement reviews, manual deprovisioning, and human-centric policy workflows lose precision as soon as workloads scale across environments.
The starting position described in the article is typical of modern enterprise estates, not an edge case. Most organisations now have more machine identities than human users, and many still try to govern them with tools and controls built for employee access.
Key questions
Q: What breaks when non-human identities are not governed like human accounts?
A: Service accounts, API keys, tokens, and AI agents can retain access long after the original task ends because they do not naturally pass through joiner-mover-leaver processes. That creates hidden privilege accumulation, weak ownership, and poor revocation discipline. The result is broader attack surface and slower response when access needs to be removed.
Q: Why do overprivileged service accounts create such persistent cloud risk?
A: Overprivileged service accounts create persistent risk because they combine standing access, weak ownership, and broad lateral movement potential. When those accounts are not tightly reviewed, an attacker or insider can move from a small foothold to broader cloud access. The issue is not only permission size, but how long that privilege remains valid.
Q: How do security teams know whether NHI governance is actually working?
A: Look for lifecycle completion, not just more inventory. Useful signals include the percentage of identities with owners, the share that are reviewed on schedule, the number of dormant credentials removed, and whether over-privileged access is shrinking in the highest-risk domains.
Q: When should organisations prioritise workload identity controls over more user-focused IAM work?
A: Organisations should prioritise workload identity controls when service accounts, automation tokens, or API keys can reach sensitive systems without strong verification. If those credentials are widespread, long-lived, or hard to inventory, they are already a material attack path and should be treated as a governance priority.
Technical breakdown
Why human IAM models struggle with non-human identity sprawl
Human IAM assumes a fairly stable population of users, relatively slow role changes, and authentication patterns that are driven by people. Non-human identities behave differently. They are created and retired with workloads, connect across services and clouds, and often use API keys, OAuth tokens, certificates, or service accounts that are embedded into automation. That difference matters because the control problem is not just authentication. It is lifecycle, privilege scope, rotation, and federation across machine-to-machine trust paths. When those identities multiply quickly, manual governance breaks down and narrow policy enforcement becomes difficult to sustain.
Practical implication: map which identities are workload-driven and stop governing them as if they were employee accounts.
Why overprivileged service accounts become a governance failure
The article makes overprovisioning a central risk. Service accounts are often granted broader access than the task requires because precise scoping takes time and is hard to maintain across distributed systems. Once that happens, the identity becomes a standing blast-radius multiplier: any compromise, misconfiguration, or leaked secret can reach more resources than intended. This is not merely a permissions issue. It is an identity governance failure because privilege no longer matches function. Traditional IAM often lacks the real-time policy enforcement needed to keep access aligned to workload context and operational change.
Practical implication: reduce standing privilege for NHIs by aligning each credential to a single workload function and resource set.
How real-time policy enforcement changes workload identity control
Real-time policy enforcement is the article’s answer to the mismatch between static IAM and dynamic NHIs. In practice, that means access decisions are evaluated at use time, not just at issuance time. Workload identity controls can factor in identity posture, environment, and policy before allowing a service to reach a database, API, or cloud resource. That mechanism matters because machine identities do not pause for manual review. If the policy layer cannot adapt at the same speed as the workload, governance falls behind the runtime state of the environment.
Practical implication: move enforcement closer to the transaction so access is decided at the point of use.
Breaches seen in the wild
- AI agent retail card theft campaign 2026: AI agents breached 27+ retailers for about $25 each, used cloud keys and a Secrets Manager dump, and stole 600,000+ payment cards.
- CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Non-human identity governance is becoming a lifecycle problem, not just an access problem. The article shows that service accounts, application credentials, and AI-adjacent workloads change faster than most access review programmes can follow. That means the control gap sits in issuance, rotation, and offboarding rather than only in entitlement visibility. Practitioners should treat NHI lifecycle as a first-class governance domain.
Traditional IAM controls are losing fit because they assume identity state is stable enough to manage manually. Human-oriented IAM works when the subject is a person with a predictable joiner-mover-leaver pattern. NHIs are created by code, tied to services, and often persist after their original use case ends. The implication is that identity governance must shift from periodic administration to continuous machine identity state management.
Overprivileged service accounts are a blast-radius problem disguised as an access control issue. When an NHI is granted more access than its function requires, compromise and misconfiguration both expand faster than defenders can contain them. The article is pointing at a governance pattern where the entitlement model and the runtime workload no longer match. Practitioners need to reduce that mismatch before it becomes a recurring incident pattern.
Identity federation and real-time policy enforcement are now core requirements for distributed NHI estates. The article’s architecture reflects a broader market reality: workloads move across clouds, APIs, and automation stacks, so access cannot depend on a single static perimeter. That makes federation and policy evaluation part of identity governance, not just security plumbing. Teams should design NHI control planes for cross-environment enforcement.
Non-human identity sprawl is forcing identity teams to think in system terms, not account terms. The article is valuable because it reframes the unit of governance from the isolated secret to the workload relationship that secret enables. That shift matters for IAM, PAM, DevSecOps, and cloud security teams alike. Practitioners should govern the connection between workload, privilege, and runtime context rather than any one artefact in isolation.
From our research library:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
- 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
What this signals
Workload identity governance is now the practical boundary of IAM maturity. As NHIs proliferate across cloud, DevOps, and API estates, the deciding question is no longer whether identity exists, but whether it can be scoped, rotated, and retired at machine speed. Teams that still centre human access processes will continue to miss the fastest-growing part of the attack surface.
Non-human identity sprawl pushes control closer to runtime. Static approvals and periodic reviews cannot keep up with identities that are created and consumed by automation. Practitioners should expect more emphasis on policy enforcement at connection time, workload posture checks, and ownership mapping across service accounts and application credentials.
For practitioners
- Define a machine-identity inventory Catalogue applications, APIs, service accounts, scripts, microservices, and AI-connected workloads so each non-human identity has an owner, purpose, and runtime dependency mapped.
- Separate workload identities from human IAM workflows Stop routing NHIs through employee onboarding, HR-driven offboarding, or manual access review cadences that were built for people rather than automated services.
- Scope each NHI to one function Replace broad service-account access with narrowly defined resource and action boundaries so a compromised credential cannot reach unrelated systems.
- Automate credential rotation and revocation Use lifecycle controls that issue, rotate, and revoke machine credentials as workloads change, especially for short-lived containers, integrations, and pipeline identities.
- Enforce policy at access time Require real-time checks for workload posture, environment, and approved resource scope before a non-human identity can connect to sensitive data or APIs.
Key takeaways
- Non-human identities now require governance patterns that treat workloads as first-class identities, not exceptions to employee IAM.
- The main failure mode is not lack of visibility alone, but access that outlives the workload and grows beyond its intended function.
- Teams should prioritise lifecycle automation, tight privilege scoping, and real-time policy enforcement to keep NHI risk from outrunning IAM controls.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST SP 800-53 Rev 5, NIST CSF 2.0 and CSA Cloud Controls Matrix set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | The article centres on broad machine permissions and service-account overprovisioning. |
| NHI-07 — Long-Lived Secrets | The article highlights credentials that persist across workload change and outlive their original purpose. | |
| NHI-01 — Improper Offboarding | Orphaned service accounts and unmanaged workload teardown are explicit risks in the article. | |
| Recommendation — Reduce standing permissions for non-human identities and scope each credential to a single workload function. Automate rotation and revocation for machine credentials that persist beyond the workload lifecycle. Tie offboarding to workload retirement so service accounts and tokens are removed when use cases end. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Credential issuance, rotation, and revocation are central to the article’s governance problem. |
| Recommendation — Apply authenticator management to automate issuance, rotation, and revocation for NHI credentials. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is about getting machine entitlements correctly scoped and continuously enforced. |
| Recommendation — Use entitlement governance to keep workload access aligned to current function and context. | ||
| CSA Cloud Controls Matrix | IAM — Identity and Access Management | The article maps directly to cloud IAM control of workload and service identities. |
| Recommendation — Extend cloud IAM governance to service accounts, APIs, and automated workloads across environments. | ||
Key terms
- Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
- Workload Identity: The identity assigned to a software workload, such as a containerised application, serverless function, or microservice, enabling it to authenticate to other services without storing static credentials.
- Service Account: A special-purpose account used by applications, automated tools, or services rather than a human user to interact with systems, APIs, and infrastructure. Service accounts are a primary category of NHI and one of the most frequently exploited attack vectors.
- Identity Federation: Identity federation is the practice of trusting one identity system to authenticate a user or workload for another system. It reduces login friction, but it also creates a dependency on assertion trust, policy consistency, and strong control over downstream authorization.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.
Published by the NHIMG editorial team on May 31, 2026.
Updated on October 6, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org