Zero trust for AI systems and NHIs: are your controls keeping up?

TL;DR: Zero Trust data security now has to evaluate access for users, service accounts, workloads, and AI systems across cloud, SaaS, and on-premises environments, according to BigID. The model only works when identity, context, data sensitivity, and continuous monitoring replace perimeter trust assumptions, and that means NHI governance can no longer sit outside IAM design.

NHIMG editorial — based on content published by BigID: Zero Trust Data Security: Protect Sensitive Data in a Connected World

By the numbers:

• When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases.

Questions worth separating out

Q: How should security teams implement Zero Trust for NHIs and AI systems?

A: Start by mapping effective access to sensitive data, not just configured permissions.

Q: Why do NHIs complicate zero trust and least privilege efforts?

A: NHIs complicate zero trust because they are numerous, persistent, and often tightly integrated into applications and pipelines.

Q: What breaks when data classification is missing from access governance?

A: Least privilege becomes too coarse to be useful.

Practitioner guidance

• Map effective access to sensitive datasets Identify who and what can actually reach high-value data through direct, inherited, and indirect entitlements.
• Classify data before tuning access policy Use sensitivity, regulatory status, and business impact to decide which datasets deserve tighter verification and shorter access lifetimes.
• Reduce standing privilege for NHIs Remove broad group memberships, stale service account rights, and inherited permissions that let machine identities browse beyond their task scope.

What's in the full article

BigID's full article covers the operational detail this post intentionally leaves for the source:

• Step-by-step breakdown of how BigID connects sensitive data to identities, permissions, and activity.
• Practical implementation examples for classifying data and mapping effective access across cloud, SaaS, and on-premises systems.
• Operational workflow detail for prioritising excessive access and triggering remediation actions.
• Use-case guidance for applying data-aware controls to AI systems and non-human identities.

👉 Read BigID's analysis of zero trust data security for identities and sensitive data →

Zero trust for AI systems and NHIs: are your controls keeping up?

Explore further

View Full Forum →  |  NHI Foundation Course →