Notifications
Clear all
Topic starter
25/06/2026 2:35 pm
TL;DR: Identity platforms now govern human and non-human access across applications, data, and business processes, according to Saviynt, with separate emphasis on NHI, just-in-time access, identity security posture management, and AI agents. The main issue is not the product label but the expanding control surface, where identity, privilege, and lifecycle governance now overlap across machine and human programmes.
NHIMG editorial — based on content published by Saviynt: Explore Saviynt's latest developments including announcements, strategic partnerships, solution enhancements, and more
By the numbers:
- Over 100 million identities protected, and counting!
- NHIs outnumber human identities by 25x to 50x in modern enterprises.
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.
Questions worth separating out
Q: How should security teams govern non-human identities and AI agents in the same programme?
A: Start by treating both as governed identity subjects, but do not assume they need identical controls.
Q: Why do service accounts and AI agents create different identity risks?
A: Service accounts are usually non-autonomous and therefore governed through credential scope, privilege, and lifecycle.
Q: What do security teams get wrong about just-in-time access for machine identities?
A: They often assume JIT alone eliminates risk, when the real issue is whether the underlying identity can still retain broad authority elsewhere.
Practitioner guidance
- Map all non-human access paths to a named owner Assign accountable owners to service accounts, API tokens, workload credentials, and AI agent access so every identity has a clear lifecycle and review path.
- Inventory secret locations outside managed vaults Search code repositories, configuration files, CI/CD systems, and embedded application settings for long-lived credentials that sit outside secrets managers.
- Reduce standing privilege for machine identities Replace persistent high-privilege access with just-in-time or task-scoped access wherever the workload supports it.
What's in the full article
Saviynt's full newsroom post covers the operational detail this post intentionally leaves for the source:
- Platform framing across identity security posture management, just-in-time access, and machine identity governance
- Product and solution areas named in the newsroom, including NHI, MCP, and ISPM for AI agents
- The company's own scope across applications, data, and business processes for human and non-human access
- Brand and market context around how Saviynt positions its identity platform and customer base
👉 Read Saviynt's newsroom update on NHI and AI agent identity governance →
Saviynt's NHI and AI agent governance stack , what changes now?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
25/06/2026 3:44 pm
Identity governance is being pulled from a human-centric model into a mixed runtime model. Saviynt's positioning shows how quickly NHI, workload, and AI agent access are converging inside the same governance stack. That convergence matters because approval, entitlement, and review processes were built around slower identity lifecycles than modern machine access patterns. Practitioners should treat this as a governance architecture shift, not a product feature list.
A few things that frame the scale:
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools, according to Ultimate Guide to NHIs.
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to Ultimate Guide to NHIs.
A question worth separating out:
Q: How do you know if NHI governance is actually working?
A: Look for fewer standing credentials, shorter credential lifetimes, clear ownership, and measurable reductions in secrets stored outside managed systems. If review results do not lead to faster revocation, cleaner offboarding, or narrower privilege, the programme is producing paperwork rather than control.
👉 Read our full editorial: Saviynt's identity platform widens NHI and AI agent governance
