Topic starter
06/07/2026 9:41 am
TL;DR: As enterprises spread workloads across hybrid cloud, containers, and agentic AI, non-human identities now make up more than 98% of identities and traditional IAM cannot keep pace, according to Token Security. The governing assumption has changed: identity is no longer a stable record to review, but a fast-moving data problem that must be correlated before remediation is safe.
Editorial analysis by NHI Mgmt Group, based on content published by Token Security: “Securing Non-Human Identities Across Cloud and Agentic AI”.
By the numbers:
- Non-human identities now represent more than 98% of all identities within the enterprise.
Key questions
Q: What breaks when NHI governance is still built around static identity records?
A: Static identity records break down when accounts, tokens, and service principals are created and consumed across multiple clouds and runtime systems faster than teams can certify them.
Q: Why do multi-cloud AI environments increase NHI risk?
A: They increase NHI risk because service accounts, tokens, and model endpoints are split across different IAM systems with incompatible policy models.
Q: How should security teams decide whether an NHI is safe to remediate?
A: Security teams should require evidence, not intuition.
Practitioner guidance
- Build a unified NHI inventory Correlate identities across AWS, Azure, GCP, Kubernetes, SaaS, CI/CD, secrets managers, and on-prem systems so ownership and runtime use are visible in one place.
- Map runtime usage before remediation Trace how each credential, token, or service account is actually consumed before revoking or narrowing access, especially where production dependencies are opaque.
- Separate short-lived workloads from human review cadences Design governance around ephemeral infrastructure by tying issuance, use, and revocation to workload duration rather than periodic certification cycles.
Bottom line: Non-human identity risk in modern enterprises is driven by fragmentation as much as scale, because cloud, container, and AI systems each create their own control gaps.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/07/2026 9:57 am
Identity as a data problem is now the correct operating model for NHI governance: fragmented cloud and AI environments produce too many identity events for manual or point-in-time control to scale. The important shift is not only volume, but correlation, because remediation decisions depend on usage, ownership, and dependency context that legacy tools keep separate. Practitioners should treat identity telemetry as a governed dataset, not a ticket queue.
A few things that frame the scale:
- 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments, according to the 2026 Infrastructure Identity Survey.
- Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How should security teams govern AI agents that use existing NHI credentials?
A: Treat every AI agent as a non-human identity with its own owner, scope, and expiry. Assign the minimum permissions needed, issue short-lived credentials where possible, and log every action the agent takes. Governance should focus on both access and behavior, because a valid credential can still be used in an unsafe way.
👉 Read our full editorial: Token Security's NHI governance model for cloud and AI sprawl