Topic starter
16/09/2026 9:21 am
TL;DR: Non-human identities now outnumber human logins by roughly 82 to 1 in the reported environment, while 28.65 million new hardcoded secrets landed on public GitHub in 2025 and AI-related leaks rose 81% year over year, according to Securden and GitGuardian research. The governance problem is no longer inventory alone, because AI agents can expand blast radius at runtime and require policy enforcement, ownership, and lifecycle control.
Editorial analysis by NHI Mgmt Group, based on content published by Securden: “Non-Human Identity Security: Why Machine and AI Agent Credentials Need Their Own Playbook”.
By the numbers:
- For every human employee who logged into systems this morning, roughly 82 non-human identities did the same behind the scenes.
- The 2025 Identity Security Landscape report surveyed 2,600 security decision-makers across 20 countries.
- Secrets tied specifically to AI services jumped 81% in the same period.
Key questions
Q: What breaks when non-human identities are managed only through inventory and quarterly review?
A: Ownership and exposure drift faster than the review cycle.
Q: Why do AI agents increase breach impact when they use NHI credentials?
A: Because the credential does not just identify the agent, it authorises a machine-speed path across systems.
Q: How can organisations tell whether their NHI controls are actually working?
A: Look for reduced secret sprawl, fewer long-lived credentials, clear ownership records, and rapid offboarding when workloads are retired.
Practitioner guidance
- Map every non-human identity to a named owner Tie service accounts, tokens, roles, and agents to a business owner and a technical custodian so no credential can exist without accountability.
- Replace standing access with time-bound issuance Use just-in-time access for credentials that only need to exist during a task, especially where an integration or agent touches production data.
- Separate agent permissions from human role models Define explicit tool and data scopes for AI agents instead of inheriting broad human entitlements that were never intended for runtime decision-making.
Bottom line: NHI governance is no longer just a discovery problem because machine identities and AI agents now shape active access paths, not just static inventories.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
16/09/2026 9:21 am
Runtime control, not inventory count, is now the governing question for NHI programmes. Discovery still matters, but it no longer solves the core problem once identities can act, chain tools, and touch live systems. The field has moved from asking whether an identity exists to whether its actions can be constrained while it is in motion. Practitioners should treat runtime enforcement as the decisive control boundary.
A few things that frame the scale:
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to the Ultimate Guide to NHIs.
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should organisations prioritise runtime policy for agents over more secret storage?
A: Yes, when the main problem is what an identity can do after it authenticates. Secret storage reduces exposure, but runtime policy limits blast radius when an agent, integration, or pipeline can still make consequential decisions mid-session. The order matters when action, not just possession, drives risk.
👉 Read our full editorial: NHI governance is becoming a runtime control problem for AI agents