Topic starter
11/08/2026 3:15 pm
TL;DR: Machine identities now outnumber human identities by as much as 144 to 1, and AI service credential leaks rose 81% in a year, according to SSH Communications Security and cited industry research. Standing privileges and long-lived secrets are no longer adequate when workloads and AI agents authenticate continuously.
Editorial analysis by NHI Mgmt Group, based on content published by SSH Communications Security: “Beyond Human Users: Why Non-Human Identities Are the Next Frontier in Cybersecurity”.
By the numbers:
- Non-human identities now outnumber human identities by as much as 144 to 1 in many organisations.
- The total number of NHIs continues to grow by more than 44% year over year.
- AI service credential leaks increased 81% in a single year.
Key questions
Q: How should teams govern privileged non-human identities in agentic systems?
A: Treat the agent as a non-human identity with scoped authority, provenance controls, and explicit action authorization.
Q: Why do long-lived secrets create more risk for infrastructure workloads?
A: Long-lived secrets are hard to inventory, rotate, and constrain across many workloads, so they tend to persist after they should be replaced.
Q: What breaks when PAM only covers human administrators?
A: A human-only PAM model leaves service accounts, workloads, and AI-connected systems outside the same governance discipline.
Practitioner guidance
- Inventory privileged NHIs by runtime role Map service accounts, API keys, workloads, CI/CD pipelines, and automation platforms to the systems they can touch, then flag identities with standing privilege or unclear ownership.
- Replace standing privilege with task-scoped access Issue credentials for the shortest workable duration and bind them to a specific operational task, especially where workloads or automation need elevated access.
- Add continuous authorization to privileged sessions Evaluate identity, target resource, and context during execution, not just at authentication, so access can be reduced or denied while activity is still in flight.
Bottom line: Machine identities have become the main privileged actors in many environments, so PAM now has to govern software-driven access at runtime instead of only protecting human administrators.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/08/2026 3:28 pm
Runtime identity control is now the correct PAM pattern for machine-driven enterprises. Static approval models do not match the way workloads, pipelines, and AI agents operate, because these identities authenticate continuously and can change behaviour faster than recertification cycles can react. The practical conclusion is that PAM has moved from session protection to execution-time governance.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
- Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems. Organisations failing to scope AI access properly are 4.5x more likely to experience a security incident, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How should security teams compare zero trust and runtime identity control for NHIs?
A: Zero trust sets the policy posture, while runtime identity control is the enforcement pattern that applies it continuously to machine actions. For NHIs, the difference matters because the risk is not just initial access but whether each privileged action still meets policy after the session has started.
👉 Read our full editorial: Runtime identity control for non-human identities in the machine-driven enterprise