Topic starter
12/06/2026 9:48 pm
TL;DR: Most organisations now have more non-human identities than people, yet many lack visibility into what exists or whether access is appropriate; Delinea says first scans typically uncover hundreds of unmanaged machine and AI identities within hours. The governance problem is no longer inventory alone, but which hidden identities carry the largest blast radius and fastest attack path.
Editorial analysis by NHI Mgmt Group, based on content published by Delinea: “Access Risk is Not Human: Now what?”.
By the numbers:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
Key questions
Q: How should security teams inventory hidden machine and AI identities?
A: Start by aggregating identity data from cloud platforms, SaaS tools, directories, CI/CD systems, and secrets stores into one operational view.
A: Unmanaged non-human identities expand the attack surface because they often outnumber human accounts, persist longer, and escape normal governance.
Practitioner guidance
- Build a full identity inventory across machine and AI estates Correlate IAM, cloud, application, and integration telemetry so service accounts, bots, APIs, and AI agents are visible in one governance view.
- Rank identities by blast radius and standing privilege Prioritise remediation for accounts that can reach sensitive systems, share secrets, or hold broad cloud permissions rather than cleaning up by volume.
- Assign ownership to every discovered non-human identity Require an accountable owner, purpose, and expiry signal for each service account, integration, or AI account before it remains active.
Bottom line: Machine and AI identities have become a mainstream governance problem because they are now part of the access estate, not an exception to it.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
13/06/2026 12:07 am
Hidden identity discovery has become a governance function, not just a detection function. Once service accounts, scripts, APIs, bots, AI agents, and workloads outnumber people, the old assumption that identity governance begins with a human directory no longer holds. The practical consequence is that ownership, lifecycle, and privilege review have to start with discovery across the full machine estate, not end there.
A few things that frame the scale:
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Who should be accountable for AI identity governance?
A: Accountability should sit with the team that owns the workflow and the team that owns identity controls, because AI access crosses both domains. Security, platform, and application owners each hold part of the lifecycle, but one business owner must remain responsible for the access decision and its removal.
👉 Read our full editorial: Identity discovery now includes machine and AI accounts at scale
This post was modified 1 day ago by NHI Mgmt Group