Topic starter
14/05/2026 12:17 pm
TL;DR: Cisco’s intent to acquire Astrix Security signals that governance for API keys, service accounts and OAuth tokens is moving into broader platform security as AI agents expand the same credential surface, according to Astrix Security. NHI control is now a platform design problem, not a niche inventory exercise.
Editorial analysis by NHI Mgmt Group, based on content published by Astrix Security: “A New Chapter: Astrix Security is Joining Cisco”.
Key questions
Q: What breaks when non-human identity ownership is unclear?
A: When ownership is unclear, rotation stalls, reviews default to approval, and nobody feels safe removing access.
Q: What problem does ownership attribution solve for service accounts and API keys?
A: It closes the gap between exposure detection and accountable remediation.
Q: How do organisations know whether NHI governance is actually working?
A: They should look for proof that every non-human identity has an owner, a purpose, a scope limit, a rotation rule, and a defined offboarding path.
Practitioner guidance
- Inventory every non-human identity class Map service accounts, API keys, OAuth tokens, certificates and workload credentials to business owners, environments and systems of use.
- Tie agentic workflows to explicit credential ownership Record which AI agent or workflow consumes each credential, what tools it may call and who can revoke it when the task changes.
- Separate discovery from entitlement approval Do not let visibility into NHI sprawl substitute for governance.
Bottom line: Non-human identities now sit on the critical path for enterprise access, so weak lifecycle governance becomes a direct security issue rather than an administrative one.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/05/2026 12:18 pm
NHI governance has moved from specialty control to platform architecture. When service accounts, API keys and OAuth tokens sit inside the same business workflows that AI agents now consume, governance can no longer live in a niche inventory process. The acquisition signals that discovery, policy and detection for non-human identities are becoming table stakes in broader security platforms. Practitioners should treat NHI governance as an architectural layer, not a standalone project.
A few things that frame the scale:
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to the Ultimate Guide to NHIs.
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should security teams authenticate AI agents in enterprise environments?
A: Use the strongest method the environment can support while keeping access short-lived and scoped. For federated and cross-system access, OAuth 2.1 with OIDC is usually the default. For trusted cloud runtimes, workload identity is often cleaner. For service-to-service traffic, mTLS can work well if certificate automation and revocation are mature.
👉 Read our full editorial: Cisco acquires Astrix Security: what it means for NHI governance