Topic starter
24/06/2026 7:42 pm
TL;DR: NHIs now outnumber human accounts by as much as 50 to 1, and attackers are increasingly using compromised human and machine credentials to move laterally into SaaS environments, according to Hydden. Existing IAM, IGA, PAM, and detection workflows were built around human account assumptions that do not hold for long-lived machine identities.
Editorial analysis by NHI Mgmt Group, based on content published by Hydden: “Non-human Identities (NHIs) are Only a Part of the Identity Visibility Problem”.
By the numbers:
- Non-human identities outnumber humans as much as 50 to 1 in many environments.
Key questions
Q: What breaks when SaaS integrations are not governed as non-human identities?
A: Teams lose visibility into who or what can reach connected systems, and attackers can use trusted credentials to move through those integrations without triggering normal human-account controls.
Q: Why do overprivileged service accounts create such persistent cloud risk?
A: Overprivileged service accounts create persistent risk because they combine standing access, weak ownership, and broad lateral movement potential.
Q: What are the signs that NHI governance is failing in an enterprise?
A: Common warning signs include unclear ownership for service accounts, secrets stored in code or configuration instead of managed vaults, infrequent rotation, and weak offboarding of API keys.
Practitioner guidance
- Build a separate NHI inventory Establish a live register for service accounts, API keys, certificates and OAuth tokens that records owner, purpose, scope and last use.
- Recertify machine privilege against workload need Review each non-human identity for current business function, effective permissions and downstream SaaS reach.
- Replace human-centric MFA assumptions Map which machine credentials cannot support interactive approval and define alternative authentication controls such as workload-bound credentials, scoped tokens and stronger secret handling.
Bottom line: Non-human identities are no longer a niche operational concern. In SaaS environments they now create the access paths that human-centric IAM controls are least prepared to govern.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 5:06 am
Human-centric IAM leaves a non-human identity governance gap: The operating assumption behind most IAM programmes is that access is attached to a person, can be challenged interactively, and can be reviewed on a human lifecycle. That assumption fails when the credential is a workload or integration, because service accounts and tokens can exist outside user onboarding, MFA and conventional decommissioning. The implication is that NHI governance is not a subset of user IAM; it is a separate control plane for machine access.
A few things that frame the scale:
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How do IAM and PAM teams split responsibility for AI agent access?
A: IAM should define what the agent can reach, while PAM should control when elevated access is available and how it is revoked. For AI agents, those responsibilities must be coordinated because programmatic identities do not fit a human session model. If scope and elevation are managed separately without a shared lifecycle view, privilege can persist longer than anyone expects.
👉 Read our full editorial: NHI governance gaps are widening as SaaS identities outgrow IAM