Topic starter
28/08/2026 12:04 pm
TL;DR: Unosecur argues that service accounts, API keys, certificates, bots and AI agents cannot be governed with employee IAM habits because machine identities scale, persist and behave differently, with CyberArk research cited showing 82 machine identities per human and 42% holding privileged or sensitive access. The real control shift is to tie discovery, ownership, short-lived credentials, least privilege, lifecycle and behavior monitoring together before compromise becomes permanent.
Editorial analysis by NHI Mgmt Group, based on content published by Unosecur: “Best practices for securing non-human identities: A practical guide for service accounts and machine identities”.
By the numbers:
- Machine identities outnumber human identities by 82 to 1 across the surveyed organizations, according to CyberArk research cited by Unosecur.
- 42% of machine identities held privileged or sensitive access, according to CyberArk research cited by Unosecur.
Key questions
Q: Why do service accounts and AI agents need different controls from human users?
A: Service accounts and AI agents authenticate and act without the predictable patterns that human identity systems expect.
Q: Why do long-lived machine credentials create more risk than short-lived access?
A: Long-lived machine credentials create more risk because they can be copied, reused, and forgotten across pipelines and infrastructure.
Q: What are the signs that non-human identity governance is starting to slip?
A: Warning signs include reliance on manual upgrade paths, ad hoc secret handling, and fragmented access management across tools and environments.
Practitioner guidance
- Define accountable owners for every NHI Tie each service account, workload identity and automation credential to a named team, application and business purpose, then require that ownership to be reviewed when the workload changes or is retired.
- Replace long-lived credentials with short-lived access Prefer workload federation, certificate-based authentication and managed identities over static passwords and API keys, and enforce automated rotation where persistent secrets remain unavoidable.
- Review effective privilege, not just assigned roles Inspect inherited permissions, trust policies, cross-account grants and rights to modify identities or infrastructure, then remove access the workload does not actively need.
Bottom line: Non-human identities need governance that starts with ownership and lifecycle, not with secrets alone.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
28/08/2026 12:04 pm
Non-human identity governance is now a first-class discipline, not a subtopic of IAM. The article makes the case that service accounts, workload identities, API keys, certificates, bots and AI agents all need separate treatment because their ownership, lifecycle and runtime patterns do not match human identity controls. That is the right framing for modern IAM programmes: the subject is identity behaviour, not just authentication method. Practitioners should treat NHI governance as a core control domain alongside human IAM and PAM.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What should organisations do when a machine identity outlives the workload it was built for?
A: Retire the identity, revoke its credentials and remove any residual trust paths immediately. A machine identity should not remain active just because the account still exists; if the workload is gone, the access has to go with it.
👉 Read our full editorial: Best practices for securing non-human identities and AI agents