Notifications
Clear all
Topic starter
15/08/2026 6:07 pm
TL;DR: Non-human identities are moving past 100:1 over the next two years, and Britive argues that vault-centric PAM cannot scale into that ratio because agentic identities are short-lived, runtime-selected, and often instantiated on demand. The core problem is not volume alone: it is the collapse of the standing-credential assumption that legacy NHI governance was built on.
NHIMG editorial — based on content published by Britive: Your NHI Population is About to 100x. Your Vault Was Only Built to Handle 10x
By the numbers:
- Non-human to human identity ratios will move past 100:1 over the next two years, according to Britive.
Questions worth separating out
Q: What breaks when organisations try to manage agentic AI with vault-centric PAM?
A: Vault-centric PAM assumes an identity persists long enough for credential issuance, storage, and reuse to make sense.
Q: Why do agentic identities change the way IAM teams should think about NHI governance?
A: Because they are not just more NHIs.
Q: How do security teams know whether their NHI model is too dependent on standing credentials?
A: Look for any workflow where access remains valid after the task is complete, especially when that access was granted to a system that acts in short bursts.
Practitioner guidance
- Inventory agentic activity already in use Map copilots, embedded SaaS assistants, developer tools, and any other runtime systems that can create access without a formal identity-team workflow.
- Classify identities by lifetime and action model Separate persistent service accounts from short-lived agentic identities and define which ones need lifecycle governance versus per-call authorisation.
- Move high-value agent actions to runtime policy checks Require policy evaluation at the moment an agent invokes a specific tool against specific resources, especially for CRM, ERP, support, SIEM, and ticketing workflows.
What's in the full article
Britive's full analysis covers the architectural detail this post intentionally leaves at the governance level:
- How agentic identities differ from service accounts, CI/CD identities, and SaaS integration users in operational practice
- Why vault-based approaches become difficult to defend when an identity may exist for seconds or minutes
- How per-call policy evaluation changes the access path for high-value use cases such as CRM, ERP, support, and security operations
- What the article recommends organisations do first when they already have hidden agentic activity in production
👉 Read Britive's analysis of why vault-centric PAM breaks as NHI populations cross 100:1 →
NHI populations crossing 100:1: what breaks in vault-centric PAM?
Explore further
15/08/2026 6:16 pm
Standing credential assumptions are being invalidated by agentic identity. Vault-centric PAM was designed for identities that persist long enough to hold a reusable secret. That assumption fails when the actor is an agent that is instantiated on demand, makes tool choices at runtime, and may disappear within minutes. The implication is that identity governance has to stop treating credential persistence as the default state for all non-human access.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to Ultimate Guide to NHIs.
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.
A question worth separating out:
Q: Should organisations treat agentic AI access differently from service account access?
A: Yes. Service accounts are usually persistent and can be managed through lifecycle controls, while agentic AI access is often ephemeral, runtime-selected, and initiated on demand. The right governance model is different because the identity behaviour is different. Treating both as the same class leads to control gaps and delayed policy decisions.
👉 Read our full editorial: Why vault-centric PAM breaks as NHI populations cross 100:1
