Topic starter
15/04/2026 3:12 pm
TL;DR: Non-human identities now outnumber human employees by at least 45 to 1, and AI-driven development is accelerating their spread across code, cloud, and autonomous workflows, according to Token Security. The governance problem is no longer theoretical: machine-first access patterns demand discovery, lifecycle control, and short-lived credentials, or blast radius will keep expanding.
Editorial analysis by NHI Mgmt Group, based on content published by Token Security: “Why Non-Human Identities Are the Fastest-Growing Security Risk in AI-Driven Enterprises”.
By the numbers:
- Non-human identities outnumber human employees by a ratio of at least 45 to 1 in enterprise environments.
Key questions
Q: What breaks when non-human identities are not governed like human accounts?
A: Service accounts, API keys, tokens, and AI agents can retain access long after the original task ends because they do not naturally pass through joiner-mover-leaver processes.
Q: What problem does ownership attribution solve for service accounts and API keys?
A: It closes the gap between exposure detection and accountable remediation.
Q: How can organisations tell whether NHI governance is actually working?
A: NHI governance is working when every machine identity has an owner, a purpose, a minimum-necessary entitlement, and evidence of rotation and review.
Practitioner guidance
- Implement continuous NHI discovery Scan cloud platforms, CI/CD pipelines, application logs, and SaaS tenants to maintain a live inventory of service accounts, API keys, OAuth tokens, and bot identities.
- Replace standing secrets with short-lived credentials Reduce the lifetime and blast radius of machine access by moving workloads toward ephemeral credentials and federation instead of reusable static keys.
- Bind privileges to workload purpose Review every over-provisioned service account and trim permissions to the minimum task scope, especially where the identity can access databases, object storage, or admin APIs.
Bottom line: The article frames non-human identity sprawl as a governance failure caused by machine speed, secret reuse, and human-centric control models.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
06/10/2026 4:28 pm
Machine identity governance is now a volume, speed, and ownership problem, not just an authentication problem. The article shows that NHIs are created by code, spread across clouds and SaaS tools, and often never re-enter central identity workflows. That means the old assumption that every important identity can be named, reviewed, and offboarded like a person no longer holds. Practitioners should treat NHI inventory completeness as a control objective, not a reporting feature.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What should organisations do when autonomous workflows create new identities on the fly?
A: Treat identity issuance as part of the runtime control plane, not as a back-office approval task. If an autonomous workflow can create resources and the identities that govern them, security teams need guardrails on creation, scope, and expiry before the task completes.
👉 Read our full editorial: Why non-human identities are the fastest-growing AI security risk