Topic starter
23/06/2026 7:30 pm
TL;DR: Unosecur argues that AI agents and other non-human identities cannot be secured with human MFA alone because they authenticate through policy, attestation, and short-lived credentials instead. The practical shift is to govern machine-native access, lifecycle, and runtime evidence as Zero Trust requirements, not extensions of human login controls.
Editorial analysis by NHI Mgmt Group, based on content published by Unosecur: “Rethinking Identity for AI Agents & NHIs”.
By the numbers:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
Key questions
Q: Why do human MFA controls fail for AI agents and service accounts?
A: Human MFA depends on an interactive person who can receive and approve a challenge, but AI agents and service accounts authenticate non-interactively.
Q: When should organisations replace static secrets with ephemeral credentials?
A: Use ephemeral credentials whenever a workload can tolerate short-lived access and the secret would otherwise persist across deploys, environments, or teams.
Q: What are the signs that NHI governance is failing in agentic AI environments?
A: NHI governance is failing when security teams cannot answer basic questions about ownership, approval, and shutdown.
Practitioner guidance
- Define machine-native authentication paths Use app-only flows, workload identities, or delegated tokens for non-human actors instead of human MFA prompts.
- Replace static secrets with ephemeral credentials Move workloads toward federation, temporary credentials, and managed identities so access expires with the task.
- Attach ownership and expiry metadata Record owner, purpose, environment, and expiry on every service account, bot, and agent identity.
Bottom line: AI agents and other non-human identities need machine-native authentication, not human MFA repackaged for software.
What's in the full article
Unosecur's full blog covers the operational detail this post intentionally leaves for the source:
- Concrete examples of non-interactive authentication flows for service accounts, workloads, and AI agents
- Implementation guidance for federation, managed identities, and short-lived credential patterns
- Attestation and mTLS design choices for proving workload identity at runtime
- Operational steps for ownership, logging, rotation, and de-provisioning of NHIs
👉 Read Unosecur's analysis of AI agent identity and NHI governance in zero trust →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 3:33 am
Machine identity has become a first-class governance domain, not a subtopic of human IAM. AI agents, workloads, and service accounts now initiate access directly, which means the identity programme must govern software actors on their own terms. Human login design cannot carry the full burden because the subject is not a person, the control loop is not interactive, and the evidence is not a password or prompt. The practitioner implication is that NHI governance must stand beside human IAM, not underneath it.
A few things that frame the scale:
- Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems. Organisations failing to scope AI access properly are 4.5x more likely to experience a security incident, according to the 2026 Infrastructure Identity Survey.
- 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
A: Security teams should pair continuous machine identity with threat detection so every machine connection is verified before it is trusted. In OT, that means authenticating devices, limiting which systems can initiate or maintain sessions, and enriching detections with identity context. This reduces blind trust in east-west traffic and gives responders clearer evidence for containment and recovery.
👉 Read our full editorial: Rethinking identity for AI agents and NHIs in Zero Trust