Topic starter
14/05/2026 5:37 pm
TL;DR: Service accounts, API keys, bots, cloud workloads, and AI agents now outnumber human identities by up to 50x, while 91% of CISOs report limited to no visibility into AI agents, according to Saviynt. Posture management is becoming a baseline control because exposure can accumulate faster than teams can discover it.
Editorial analysis by NHI Mgmt Group, based on content published by Saviynt: “No-Cost Security for AI Agents and Non-Human Identities”.
By the numbers:
- 91% of CISOs report limited to no visibility into AI agents.
Key questions
Q: What breaks when non-human identities are not covered by baseline posture management?
A: When non-human identities sit outside baseline posture management, teams lose inventory, ownership, and exposure visibility at the point where risk is accumulating fastest.
Q: Why do limited visibility and long-lived non-human credentials create so much identity risk?
A: Limited visibility means teams cannot see which identities still exist, who owns them, or what they can reach.
Q: How should security teams prioritise non-human identity remediation?
A: Prioritise the identities with the largest blast radius first.
Practitioner guidance
- Discover the full non-human identity estate Inventory service accounts, API keys, bots, cloud workloads, and AI agents across environments, then reconcile them against ownership, purpose, and business system.
- Map access paths to sensitive resources Trace how each identity reaches high-value systems through roles, inherited permissions, delegated trust, and application integrations.
- Flag excessive privilege and dormant accounts Prioritise identities that have broad permissions, no recent activity, or no clear owner because they are the easiest path to hidden exposure.
Bottom line: Non-human identities are now large enough in number and operational reach that baseline posture coverage is a governance requirement, not a discretionary add-on.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/05/2026 5:39 pm
Baseline coverage is now the right governance default for non-human identities. When service accounts, API keys, bots, cloud workloads, and AI agents outnumber human identities by up to 50x, limiting posture management to premium tiers turns exposure into a rationed control. The governance problem is not whether these identities matter, but whether organisations can justify leaving the fastest-growing part of the identity estate partially invisible. The practitioner conclusion is simple: baseline coverage belongs in the core identity programme, not as an optional add-on.
A few things that frame the scale:
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to the Ultimate Guide to NHIs.
- 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What should teams do to keep AI agent posture from drifting out of control?
A: Treat AI agents like governed identities, not just automation endpoints. Continuously discover them, map their access paths, and track posture changes whenever their integrations, permissions, or runtime behaviour changes. That keeps the identity programme focused on actual exposure rather than static approval records.
👉 Read our full editorial: AI agent and NHI posture management should be baseline coverage