Notifications
Clear all
Topic starter
27/06/2026 1:35 pm
TL;DR: Non-human identities now outnumber human users by 10x or more in many enterprises, yet they are often created outside governance workflows, rarely reviewed, and frequently left with static, over-privileged credentials, according to Zluri. Identity programmes built around employee lifecycles are missing the security surface that attackers increasingly prefer.
NHIMG editorial — based on content published by Zluri: Non-Human Identities Are Your Biggest Security Blind Spot (And Most Teams Don't Know It Yet)
By the numbers:
- Non-human identities outnumber human users by 10x or more in many enterprise environments.
Questions worth separating out
Q: How should security teams govern non-human identities across SaaS and cloud environments?
A: Start by inventorying every service account, API token, automation account, and machine identity, then attach an owner, purpose, and expiry condition to each one.
Q: Why do non-human identities create more risk than many teams expect?
A: They often combine three dangerous traits: persistent access, elevated privilege, and weak oversight.
Q: What breaks when service accounts are not part of access reviews?
A: Permissions accumulate without challenge, orphaned accounts remain active, and unused privileges become permanent attack paths.
Practitioner guidance
- Build a complete NHI inventory Catalogue service accounts, API tokens, bots, automation accounts, machine identities, and AI agents across SaaS, cloud, and DevOps systems.
- Attach lifecycle ownership to every non-human identity Assign a named operational owner for provisioning, review, rotation, and offboarding.
- Reduce standing privilege on long-lived credentials Replace broad, persistent permissions with narrowly scoped access aligned to a single workload or integration.
What's in the full article
Zluri's full article covers the operational detail this post intentionally leaves for the source:
- A fuller breakdown of the specific NHI categories found across service accounts, tokens, bots, workloads, and AI agents
- More detail on why traditional IAM and IGA workflows miss non-human identities during provisioning and review
- The source article's practical discussion of visibility, lifecycle, and governance gaps that emerge in real environments
- Context on Zluri's identity intelligence approach for teams trying to inventory and control hidden access paths
👉 Read Zluri's analysis of why non-human identities are your biggest security blind spot →
NHI blind spots in enterprise identity programmes: what teams miss?
Explore further
27/06/2026 2:57 pm
Human-centric identity governance is now structurally incomplete. The article shows that most enterprise identity programmes still assume a person is behind the account, but NHIs do not follow hire, transfer, and exit workflows. That assumption fails when service accounts, tokens, and machine identities are created outside HR-driven processes and never enter the review loop. The implication is that identity governance must be measured by its treatment of non-human actors, not by its employee coverage.
A few things that frame the scale:
- Strong governance starts with visibility, and only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- The same research shows that 97% of NHIs carry excessive privileges, which explains why inventory alone is not enough without entitlement reduction and ownership.
A question worth separating out:
Q: What is the difference between managing human users and non-human identities?
A: Human identity management is driven by employment events, managers, and user behaviour. Non-human identity management is driven by application ownership, integration purpose, secret rotation, and workload change. The controls overlap, but the lifecycle logic is different, so programmes that treat them the same will miss the most persistent access paths.
👉 Read our full editorial: Non-human identity blind spots are undermining enterprise security
