Notifications
Clear all
Topic starter
30/07/2026 10:48 pm
TL;DR: Agentic AI is accelerating the spread of non-human identities that operate at machine speed, while most enterprises still manage them with human-first IAM controls, according to Token Security. The governance problem is no longer visibility alone, but the assumption that identity use is stable, owned, and reviewable over time.
NHIMG editorial — based on content published by Token Security: Why I Joined Token Security: Tackling the AI & Identity Crisis No One Sees Coming
By the numbers:
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys.
Questions worth separating out
Q: What breaks when organisations manage AI agents like human users?
A: Human-user controls assume a stable person, a predictable login journey, and a review cycle that matches work patterns.
Q: Why do service accounts and API keys create such a large attack surface?
A: Service accounts and API keys often persist longer than the workflow that created them, and they are frequently embedded in code, pipelines, or shared systems.
Q: How do security teams know whether NHI governance is actually working?
A: Look for coverage across ownership, inventory, usage context, and revocation speed.
Practitioner guidance
- Map every non-human identity to a named owner Build an authoritative inventory that ties each service account, API key, token, certificate, and AI agent to a business owner and technical steward.
- Prioritise credential paths embedded in code and pipelines Search code repositories, configuration files, CI/CD tools, and automation workflows first because those are the most common places machine credentials persist undetected.
- Separate human authentication from machine execution governance Do not let human IAM policies stand in for machine identity controls.
What's in the full article
Token Security's full blog covers the operational detail this post intentionally leaves for the source:
- How its context-driven NHI Security model maps ownership, usage, and permissions across environments
- The specific ways Token says it links NHIs to Infrastructure-as-Code origins and cloud, SaaS, CI/CD, and AI workflows
- Examples of the drift, risk, and anomaly signals the vendor says it delivers to responders
- The article's fuller explanation of how the platform positions continuous visibility and remediation across NHIs
👉 Read Token Security's blog on why AI and identity are colliding →
AI agent identity risk: what IAM teams are missing today?
Explore further
30/07/2026 10:54 pm
Human-first IAM assumptions are breaking under machine-native identity use. The article correctly identifies the central failure: human identity tooling is being stretched across service accounts, API keys, automation workflows, and AI agents that do not behave like people. That is a structural mismatch, not a tuning problem. The implication is that identity governance now has to distinguish between human authentication, machine execution, and autonomous runtime behaviour rather than collapsing them into one control model.
A few things that frame the scale:
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures, according to Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, which explains why discovery alone rarely closes the governance gap.
A question worth separating out:
Q: Who should be accountable when a non-human identity is compromised?
A: Accountability should sit with the owner of the identity, the platform team operating it, and the security function overseeing control design. If that chain is unclear, offboarding fails and stale credentials remain active. Frameworks such as Zero Trust and NHI governance both depend on clear ownership and enforceable lifecycle control.
👉 Read our full editorial: AI agent identity risk is exposing the limits of human-first IAM
