Topic starter
06/06/2026 11:06 am
TL;DR: Nonhuman identities outnumber human identities at 144 to 1, up from 92 to 1 a year earlier, according to Aembit citing Entro Security H1 2025 research, while two in five SaaS platforms still fail to distinguish them from human users. Human IAM controls do not map cleanly to machine identities, so governance has to shift toward granular scoping, automated lifecycle management and just-in-time credential issuance.
Editorial analysis by NHI Mgmt Group, based on content published by Aembit: “How to Distinguish Between Human and Nonhuman Identities”.
By the numbers:
- Nonhuman identities now outnumber human identities at a ratio of 144 to 1, according to Entro Security’s H1 2025 research, up from 92 to 1 just one year earlier.
Key questions
Q: What breaks when organisations manage machine identities like user accounts?
A: The programme loses visibility, ownership, and lifecycle control.
Q: Why do long-lived service account credentials increase breach risk?
A: Long-lived credentials create standing access that remains valid after a workload, integration or operator has changed.
Q: What are the signs that non-human identity governance is starting to slip?
A: Warning signs include reliance on manual upgrade paths, ad hoc secret handling, and fragmented access management across tools and environments.
Practitioner guidance
- Classify human and nonhuman identities separately Tag service accounts, API tokens, automation credentials and AI agents as a distinct identity class in your inventory, then keep them out of user-only review paths.
- Tighten privilege at issuance Scope each machine identity to a single task or workload and avoid broad standing permissions that persist beyond the original business need.
- Automate NHI lifecycle and revocation Create provisioning, rotation and offboarding triggers for machine identities so credentials do not remain valid after a workload, integration or vendor relationship changes.
Bottom line: Human and nonhuman identities require different governance models because they behave differently, authenticate differently and fail differently when controls are misapplied.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
06/06/2026 11:41 am
Human and nonhuman identity governance is diverging because the actor behaviour is diverging. Human IAM assumes interactive users, reviewable sessions and predictable login patterns. NHIs and AI agents operate through programmatic access, persistent credentials and automated execution, so the governance model must split along actor type rather than force one control plane to serve both. The practical conclusion is that identity programmes need separate policy, inventory and lifecycle paths for humans and machines.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How do IAM and IGA teams handle human and non-human access in AI projects?
A: They need one governance model that ties people, service accounts, bots, and tokens to the OpenAI actions they can perform. Without that cross-identity view, reviews become fragmented and auditors cannot see who can do what across the full AI stack.
👉 Read our full editorial: Human and nonhuman identity controls are diverging fast
This post was modified 1 day ago by NHI Mgmt Group