Non-human and agentic identity sprawl: what IAM teams need to do

TL;DR: As NHIs, workloads, APIs, and agentic identities spread across cloud and on-prem environments, visibility, ownership, and post-auth control become harder to sustain, according to Unosecur. The governance gap is now structural: access reviews assume stable ownership and reviewable privilege, while these identities are created ad hoc, persist quietly, and change behaviour at runtime.

NHIMG editorial — based on content published by Unosecur: Rise of the Unseen: Managing the Non-Human and Agentic Identity Explosion

By the numbers:

• Only 5.7% of organisations have full visibility into their service accounts.
• NHIs outnumber human identities by 25x to 50x in modern enterprises.
• 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures.

Questions worth separating out

Q: How should security teams govern non-human identities in cloud environments?

A: Start with complete discovery, because you cannot govern what you cannot see.

Q: What problem does ownership attribution solve for service accounts and API keys?

A: It closes the gap between exposure detection and accountable remediation.

Q: What do security teams get wrong about access reviews in identity governance?

A: Teams often treat access reviews as a complete control, when they are really a delayed verification step.

Practitioner guidance

• Build a continuously updated NHI inventory Correlate identities from cloud, code, IAM, and application telemetry so service accounts, API keys, and workloads are not managed as separate silos.
• Replace model-account sprawl with usage-based privilege design Review access based on what each non-human identity actually does in production, then remove inherited permissions that are never exercised.
• Baselined behaviour against peer identities Measure each identity against similar accounts performing comparable tasks so drift is visible before it becomes an incident.

What's in the full article

Unosecur's full blog covers the operational detail this post intentionally leaves for the source:

• A longer breakdown of discovery and observability patterns across cloud, on-prem, SaaS, and code.
• More detail on how NHI behaviour baselining and peer comparison are used to separate normal access from drift.
• Additional discussion of post-auth controls, including token abuse, privilege escalation, and session interference.
• The article's own framing of how human IAM concepts map into machine and agent identity governance.

👉 Read Unosecur's analysis of non-human and agentic identity explosion →

Non-human and agentic identity sprawl: what IAM teams need to do?

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →