Notifications
Clear all
Topic starter
21/08/2026 4:58 pm
TL;DR: Non-human identity security must govern service accounts, workload identities, secrets, OAuth grants, bots, and AI agents as a living access estate, not a static inventory, according to Living Security Human Risk Management Platform. The article argues that ownership, lifecycle control, short-lived credentials, and behavioral context are now the decisive controls when machine-speed access can become an attack path.
NHIMG editorial — based on content published by Living Security Human Risk Management Platform: Non Human Identity Security: Managing Machine Risk
By the numbers:
- Only 5.7% of organisations have full visibility into their service accounts.
- NHIs outnumber human identities by 25x to 50x in modern enterprises.
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface.
Questions worth separating out
Q: What problem does ownership attribution solve for service accounts and API keys?
A: It closes the gap between exposure detection and accountable remediation.
Q: Why do non-human identities create more risk than many human accounts?
A: NHIs often outnumber human users, have broader permissions, and operate with less day-to-day review.
Q: What do security teams get wrong about secret rotation?
A: They often treat rotation as a substitute for removing the underlying credential model.
Practitioner guidance
- Build a complete NHI inventory Map service accounts, workload identities, secrets, OAuth grants, bots, certificates, and AI-agent-connected access across cloud, code, SaaS, and security tooling.
- Attach a named owner to every machine identity Require a human sponsor for each identity and make that owner responsible for approval, rotation, reassessment, and retirement.
- Shorten credential lifetime and revoke faster Replace static keys and long-lived tokens with short-lived credentials where possible, then test that revocation actually cuts off downstream access.
What's in the full article
Living Security Human Risk Management Platform's full blog post covers the operational detail this post intentionally leaves for the source:
- The article's full lifecycle guidance on discovery, ownership, rotation, and retirement for machine identities.
- The specific Human Risk Management context used to connect human approval, machine access, and threat signals.
- The operational examples behind OAuth grants, shadow automation, and AI-agent tool use.
- The vendor's implementation framing for correlating identity, access, and threat telemetry.
Non-human identity security: what governance gap teams are missing?
Explore further
21/08/2026 5:14 pm
Non-human identity governance fails when ownership is fragmented across teams. Identity teams, cloud teams, developers, and business owners may each manage a slice of the access stack, yet no one sees the full chain from approval to credential to runtime use. That creates blind spots around who is accountable when an OAuth grant, service account, or AI-connected integration turns risky. The practitioner conclusion is that ownership has to be explicit across the whole NHI estate, not inferred from tooling.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to Ultimate Guide to NHIs.
- 79% of organisations have experienced secrets leaks, with 77% of these incidents resulting in tangible damage.
A question worth separating out:
Q: How can security teams tell whether NHI governance is working?
A: They should look for fewer orphaned accounts, shorter credential lifetimes, lower secret reuse and faster decommissioning when systems or projects end. If credentials still survive after business purpose has ended, the governance model is not controlling the lifecycle effectively.
👉 Read our full editorial: Non-human identity security needs lifecycle governance, not inventory
