Notifications
Clear all
Topic starter
16/09/2026 9:21 am
TL;DR: Non-human identities now outnumber human logins by roughly 82 to 1 in the reported environment, while 28.65 million new hardcoded secrets landed on public GitHub in 2025 and AI-related leaks rose 81% year over year, according to Securden and GitGuardian research. The governance problem is no longer inventory alone, because AI agents can expand blast radius at runtime and require policy enforcement, ownership, and lifecycle control.
NHIMG editorial — based on content published by Securden: NHI security has become its own discipline
By the numbers:
- For every human employee who logged into your systems this morning, roughly 82 non-human identities did the same behind the scenes.
- 28.65 million new hardcoded secrets landed on public GitHub in 2025 alone, up 34% year over year.
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers.
Questions worth separating out
Q: What breaks when non-human identity ownership is unclear?
A: When ownership is unclear, rotation stalls, reviews default to approval, and nobody feels safe removing access.
Q: Why do AI agents complicate existing IAM and NHI governance models?
A: AI agents complicate governance because access is no longer confined to a single environment or a single identity type.
Q: How do security teams know if NHI controls are actually working?
A: Look for complete inventory coverage, clear ownership, enforced rotation, and evidence that unused credentials are removed on time.
Practitioner guidance
- Map every non-human identity to an accountable owner Tie service accounts, API keys, tokens, certificates, and AI agents to a named business or technical owner, then remove identities that cannot be assigned to a real owner.
- Replace standing machine credentials with time-bound access Issue just-in-time access for workload tasks and revoke it automatically when the task ends.
- Automate decommissioning for orphaned and idle identities Connect identity discovery to offboarding so service accounts, tokens, and agents are removed when the project, pipeline, or integration ends.
What's in the full article
Securden's full article covers the operational detail this post intentionally leaves for the source:
- Ownership mapping and relationship graphing for tracking service accounts, keys, and AI agents across environments
- Just-in-time access design for replacing standing credentials in workloads and integrations
- Automated lifecycle cleanup for orphaned identities and idle machine access
- Runtime policy enforcement concepts for AI agents that need mid-action scoping
👉 Read Securden's analysis of NHI governance and AI agent access control →
AI agents and NHI sprawl: what IAM teams need to rework now?
Explore further
16/09/2026 9:21 am
Identity governance is now a runtime discipline, not a periodic review exercise. Once AI agents can choose actions and tools at execution time, the old assumption that access can be certified after the fact breaks down. Access review tells you who had privilege, but not whether the actor’s behaviour stayed within the intended boundary. The practitioner conclusion is simple: governance must move closer to execution.
A few things that frame the scale:
- 91.6% of secrets remain valid five days after notification, according to Ultimate Guide to NHIs.
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.
A question worth separating out:
Q: Should organisations prioritise vaulting or lifecycle automation for NHI risk?
A: Lifecycle automation should come first when credentials, tokens, and service accounts outlive their useful purpose. Vaulting reduces where secrets are stored, but it does not solve stale access, orphaning, or delayed offboarding. If the identity still exists after the task is over, the real problem remains.
👉 Read our full editorial: NHI governance is becoming a runtime control problem for AI agents
