Topic starter
11/06/2026 10:47 pm
TL;DR: For every person in an organisation there are about 92 non-human identities, and 69% of organisations are concerned about attacks from them while only 15% feel confident preventing them, according to JumpCloud. The governance problem is no longer just volume but persistent, poorly owned machine access that IAM programmes were never built to control.
Editorial analysis by NHI Mgmt Group, based on content published by JumpCloud: “Non-Human Identities As The Next Big Security Risk”.
By the numbers:
- For every person in an organization, there are about 92 non-human identities.
- 69% of organizations are concerned about attacks from non-human identities.
- Only 15% feel confident in their ability to prevent attacks from non-human identities.
Key questions
Q: What breaks when non-human identity ownership is unclear?
A: When ownership is unclear, rotation stalls, reviews default to approval, and nobody feels safe removing access.
Q: What problem does ownership attribution solve for service accounts and API keys?
A: It closes the gap between exposure detection and accountable remediation.
Q: How can organisations tell whether NHI governance is actually working?
A: NHI governance is working when every machine identity has an owner, a purpose, a minimum-necessary entitlement, and evidence of rotation and review.
Practitioner guidance
- Map the full NHI estate Build an inventory of service accounts, API keys, certificates, tokens, and workload identities, then record owner, purpose, privilege scope, and expiry for each one.
- Remove standing privilege from machine credentials Replace broad permanent access with task-scoped permissions where automation can tolerate it, and force explicit justification for any persistent elevated access.
- Create lifecycle ownership for every non-human identity Assign a named owner to each credential so rotation, decommissioning, and offboarding are no longer informal or team-dependent.
Bottom line: Non-human identities now represent a major share of enterprise access, and unmanaged growth turns them into a hidden attack surface.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
12/06/2026 7:07 am
Non-human identity sprawl is no longer a hygiene problem, it is an architectural trust problem. The article shows that machine identities now outnumber human identities by orders of magnitude and are often created faster than governance can track them. That means the real failure is not just volume but the assumption that background credentials can remain background assets. The practitioner conclusion is that NHI inventory and ownership have to sit inside the identity programme, not beside it.
A few things that frame the scale:
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to the Ultimate Guide to NHIs.
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How should teams govern non-human identities in AI-heavy environments?
A: Teams should govern non-human identities the same way they govern other privileged assets: assign ownership, minimise scope, rotate credentials regularly, and monitor for abnormal use. The key difference is speed. AI-driven workflows can exploit exposed access quickly, so detection and revocation must be automated and tied to lifecycle controls.
👉 Read our full editorial: Non-human identity sprawl is now the enterprise security blind spot
This post was modified 4 days ago by NHI Mgmt Group