Notifications
Clear all
Topic starter
09/07/2026 1:41 pm
TL;DR: Enterprises are accumulating non-human identities far faster than they govern them, with service accounts, API keys, OAuth tokens, and AI agent credentials expanding attack surface across cloud, SaaS, and AI workflows, according to Unosecur. The governance model is now out of date: discovery, lifecycle control, and runtime visibility have to catch up before access sprawl becomes incident sprawl.
NHIMG editorial — based on content published by Unosecur: Non-Human Identity Governance: The Security Gap Enterprises Are Racing to Close
By the numbers:
- There are 144 non-human identities for every human identity in a modern automotive enterprise.
- Only 5.7% of organisations have full visibility into their service accounts.
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security.
Questions worth separating out
Q: What breaks when non-human identities are created without ownership and expiry controls?
A: When NHIs are created without ownership and expiry, they become orphaned credentials that outlive the business reason for their existence.
Q: Why do service accounts and API keys increase risk in cloud and SaaS environments?
A: Service accounts and API keys increase risk because they often carry standing access that is broader than the task they support.
Q: What do security teams get wrong about AI agent governance?
A: Teams often treat AI agents like ordinary workloads and govern only the credential, not the runtime behaviour.
Practitioner guidance
- Build a full NHI inventory first Scan cloud accounts, SaaS integrations, CI/CD systems, and AI workloads to enumerate service accounts, API keys, OAuth tokens, certificates, and workload identities.
- Right-size permissions at provisioning time Scope minimum required access before a credential or role is used in production, especially for copied templates and agent workloads.
- Automate rotation and revocation triggers Trigger rotation on age, inactivity, project closure, and vendor offboarding rather than relying on manual reminders.
What's in the full article
Unosecur's full blog covers the operational detail this post intentionally leaves for the source:
- The lifecycle-stage breakdown for creation, active use, rotation, and offboarding across service accounts, API keys, OAuth tokens, and AI agents.
- The runtime monitoring approach for spotting abnormal NHI behaviour, including the detection patterns used for cloud and SaaS activity.
- The MCP Gateway explanation for AI agent tool calls and how protocol-layer controls change visibility and authorisation.
- The implementation examples for inventory, least-privilege scoping, and deprovisioning in mixed cloud and AI environments.
👉 Read Unosecur's analysis of non-human identity governance and AI agent risk →
NHI governance is the gap enterprises keep underestimating?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
09/07/2026 1:45 pm
Non-human identity governance is now a lifecycle discipline, not an inventory project. The article is right to frame the problem as creation, use, rotation, and offboarding rather than as a single control failure. That lifecycle view matches how NHIs actually fail in enterprise environments: they are born over-scoped, remain opaque in use, and survive after the business process has ended. The implication is that identity programmes must be judged by whether they can continuously govern machine identities from birth to retirement.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to Ultimate Guide to NHIs.
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to Ultimate Guide to NHIs.
A question worth separating out:
Q: Who is accountable when a non-human identity is left active after a project ends?
A: Accountability should sit with the business owner who approved the identity, the technical owner who provisioned it, and the security function that set the policy. If no one owns offboarding, the credential becomes permanent by accident. That is exactly why lifecycle governance must be explicit for machine identities, not assumed.
👉 Read our full editorial: Non-human identity governance is the security gap enterprises must close
