TL;DR: Non-human identities now span service accounts, API keys, tokens, certificates, workloads and AI agents, and Opti’s explainer shows they are multiplying as cloud, DevOps and automation expand. NHI governance has to move from inventory alone to ownership, lifecycle control and continuous monitoring before access sprawl turns into breach exposure.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Opti's blog post: Non-human identity growth is accelerating across cloud, DevOps, APIs and AI agents, and governance must shift from simple inventory to ownership, rotation and continuous monitoring.
Why it matters: This matters because machine access is now part of the core identity estate, so IAM, PAM and governance teams need lifecycle controls that work for service accounts, tokens, certificates and AI-driven automation.
By the numbers:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
Context
Non-human identity is the governance problem that appears when software, not people, needs authenticated access to other systems. As cloud platforms, pipelines and AI-driven automation expand, the number of identities to govern rises faster than the number of human accounts, which breaks control models built around users and help desks.
The key failure is not simply scale. It is that service accounts, API keys, tokens and certificates are often created programmatically, reused across systems and left active after the workload changes. That means the identity estate can grow faster than ownership, review and revocation processes can keep up.
The same issue shows up across machine identities, workload identities and automated integrations. Non-Human Identity (NHI) Guide is the right baseline for readers who want the broader control model behind this analysis.
Key questions
Q: How should teams inventory non-human identities across cloud and DevOps environments?
A: Teams should build a single inventory of every service account, API key, token, certificate and workload identity used by cloud platforms, CI/CD pipelines, infrastructure code and automation tools. Each entry should record the owning team, system, permissions, secret location, expiry or rotation date, and whether the identity is human-created, machine-generated or inherited from a platform role. Unowned or stale credentials should be flagged for review and removal.
Q: Why do privileged service accounts create outsized risk in identity environments?
A: Privileged service accounts can be used quietly by attackers to move across systems without triggering the same scrutiny applied to human users. They often have broad access, weak password hygiene, and limited visibility. When these accounts are unmanaged, they increase blast radius, complicate detection, and make containment slower after compromise.
Q: Why do API keys and tokens need non-human identity governance?
A: Because they behave like access-bearing identities, not static configuration values. If they are long-lived, over-scoped, or shared across workloads, they can be reused by attackers exactly as legitimate systems use them. Governance should therefore cover ownership, scope, rotation, monitoring, and retirement.
Q: How should teams respond when a non-human credential is compromised?
A: They should resolve ownership first, then revoke or rotate the credential and assess downstream dependencies. If the owner is unknown, responders lose time reconstructing responsibility from logs and chat trails, which slows containment and increases the chance of missed access paths.
Technical breakdown
Why non-human identities multiply faster than user accounts
NHIs grow because each new application, service, pipeline or device often needs its own credential to authenticate without a person in the loop. In practice, cloud workloads, microservices, serverless functions and automation tools each introduce another access path, and each path tends to carry its own ownership, rotation and authorization demands. That means the problem is not only volume, but the way modern architectures create many small identities with different lifecycles and different failure modes. Read the Ultimate Guide to NHIs.
Practical implication: Treat identity growth as an architectural outcome, not an admin backlog, and model where each new workload creates a new credential boundary.
How service accounts, API keys and tokens differ in governance
Service accounts, API keys and OAuth tokens all authenticate non-human actors, but they fail in different ways. Service accounts often carry standing entitlements and are easy to overprivilege. API keys are frequently embedded in code or configuration and can leak silently. OAuth tokens are usually scoped and short-lived, but they can still be abused if revocation and storage are weak. A mature programme distinguishes these credential types because discovery, rotation and offboarding controls are not interchangeable. See the NHI Authentication Guide.
Practical implication: Classify each NHI credential type separately so rotation, storage and revocation controls match the actual failure mode.
Why machine certificates are identity assets, not just cryptography
Machine certificates are credentials that establish mutual trust between systems, not just encrypted transport. Their security depends on issuance, renewal, revocation and inventory, because an expired or compromised certificate can interrupt services or leave a trust relationship open longer than intended. In operational environments, certificate lifecycle is identity governance by another name: who owns the certificate, what it authenticates, how long it is valid and when it is retired all matter as much as the crypto itself. Read Guide to NHI Rotation Challenges.
Practical implication: Govern certificates through lifecycle ownership and renewal tracking, not as isolated PKI artefacts.
Threat narrative
Attacker objective: The objective is to turn unattended machine access into broad operational reach without needing a human account.
- Entry occurs when an exposed or unmonitored non-human credential gives an attacker a usable authentication path into a workload, API or pipeline.
- Escalation follows when that credential carries broader permissions than the task required, allowing the attacker to move from initial access to higher-value systems or actions.
- Impact comes when the attacker uses the inherited access to reach sensitive services, disrupt operations, or exfiltrate data from connected systems.
Breaches seen in the wild
- AI agent retail card theft campaign 2026: AI agents breached 27+ retailers for about $25 each, used cloud keys and a Secrets Manager dump, and stole 600,000+ payment cards.
- Spain's first AI agent data breach 2026: Spain's AEPD logged its first breach notification attributed to an attacker's AI agent, which altered personal data and accessed invoices.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Non-human identity governance fails when ownership is optional: an identity without a named owner becomes a credential with no accountable lifecycle. Opti’s explainer reflects a broader enterprise pattern in which service accounts, tokens and certificates are created to solve operational problems but are not retired with the same discipline. The result is not just clutter but unassigned risk that no review process can easily close.
Visibility is necessary but insufficient: inventory tells you what exists, but it does not tell you whether the credential is still justified, still used or still safe to leave active. That is why NHI programmes collapse when they stop at discovery and do not connect usage telemetry to access review and deprovisioning decisions. Practitioners need governance evidence that follows actual use, not just static entitlements.
Machine identity is now a core IAM domain, not a niche security category: the same controls that govern human access assumptions do not cleanly fit workload identities, API keys and automation tokens. This is where human and non-human identity diverge most sharply: humans are reviewed through interactive behaviour, while NHIs must be governed through lifecycle, scope and rotation. The practical implication is that IAM, PAM and cloud teams need a shared machine-identity operating model.
Long-lived access creates identity blast radius: every extra day a token, certificate or service account stays valid increases the number of systems it can reach if compromised. That is why the real control objective is not only preventing leaks, but reducing how far any single credential can travel once misused. Practitioners should think in terms of blast radius, not just credential count.
AI agents sharpen the NHI problem rather than replacing it: when automated systems can request, use and discard access at machine speed, governance pressure shifts to issuance, authorization and revocation timing. The field should stop treating agentic workloads as an exception and start treating them as high-velocity NHIs with stricter ownership expectations.
From our research library:
- 69% of organisations still authenticate machine identities with long-lived API keys, according to the 2026 State of AI Agent Identity Security Report.
- Read next: Guide to NHI Rotation Challenges
What this signals
Credential blast radius: the key governance question is no longer whether a machine credential exists, but how far it can travel if exposed. Programmes that still equate control with simple discovery will miss the real exposure window, which is created by standing permissions, weak revocation and incomplete ownership.
Identity teams should expect AI-driven workflows to increase the number of credentials that behave like ephemeral access requests but are governed like static assets. That mismatch pushes review and rotation to the front of the control stack, because waiting for periodic recertification leaves too much machine access outside human observation.
The practical shift is toward issuing access only when needed, limiting scope from the start and treating revocation as a normal operational event rather than an exception. That is where the broader NHI model becomes a programme-level reference point rather than a glossary concept.
For practitioners
- Build a complete NHI inventory Record every service account, API key, token, certificate and workload identity with owner, purpose, environment and expiry so no credential exists outside governance.
- Assign owners at creation time Require each new non-human identity to have a named owner responsible for access scope, rotation, and retirement before the credential is approved for use.
- Separate rotation by credential type Use different rotation and revocation rules for service accounts, API keys, OAuth tokens and certificates because each one fails differently under exposure.
- Review NHIs on the same cadence as human accounts Include machine identities in scheduled access reviews, then validate last-used activity, privilege scope and business justification instead of relying on entitlement lists alone.
Key takeaways
- Non-human identities are now a routine part of the enterprise identity estate, and their security depends on lifecycle control rather than discovery alone.
- Service accounts, API keys, tokens and certificates fail in different ways, so one rotation or review model will not fit every credential type.
- The strongest governance lever is ownership tied to scope, use and retirement, because unattended machine access creates the widest breach surface.
Related NHI Mgmt Group resources: Ultimate Guide to NHIs · Guide to NHI Rotation Challenges · NHI Ownership and Accountability Guide · Service Account Security Guide
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | Inactive NHIs and retired workloads must be revoked, which is central to the lifecycle problem here. |
| NHI-05 — Overprivileged NHI | The post repeatedly warns that service accounts and automation identities often carry excess access. | |
| NHI-07 — Long-Lived Secrets | API keys, tokens and certificates are highlighted as credentials that must be rotated and expired. | |
| Recommendation — Revoke NHIs promptly when workloads, services or integrations are retired. Scope each NHI to the minimum permissions needed for its function. Replace long-lived secrets with shorter-lived credentials and enforced renewal. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Credential rotation and revocation are core issues for the non-human identities described here. |
| Recommendation — Apply authenticator lifecycle controls to rotate and retire machine credentials. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | NHI permissions and entitlement scope are a central governance concern in the post. |
| Recommendation — Review NHI entitlements regularly and remove access that no longer matches the task. | ||
Key terms
- Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
- Service Account: A special-purpose account used by applications, automated tools, or services rather than a human user to interact with systems, APIs, and infrastructure. Service accounts are a primary category of NHI and one of the most frequently exploited attack vectors.
- API Key: A unique identifier used to authenticate a software application or service when calling an API. API keys are static, long-lived credentials and a major source of secrets sprawl. In 2024, over 50 million leaked API keys were found on the dark web.
- OAuth Token: A short-lived access credential issued by an OAuth 2.0 authorisation server granting an NHI scoped access to specific resources for a defined period. Preferred over static API keys because their short lifetime limits the exploitation window if intercepted.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on November 4, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org