Topic starter
16/01/2026 3:44 pm
TL;DR: Non-human identities now outnumber people by 10-to-1 to 92-to-1 in typical enterprises, while fragmented human identity management across on-premises, cloud, and hybrid environments makes IAM harder to govern, according to One Identity. The governance gap is no longer a future problem because autonomous systems expand privilege faster than legacy controls can safely review it.
Editorial analysis by NHI Mgmt Group, based on content published by One Identity: “How agentic AI and non-human identities are transforming cybersecurity”.
By the numbers:
- Within the average enterprise, non-human identities now outnumber employees, contractors, and customers by anything between 10-to-1 and 92-to-1.
Key questions
Q: How should teams govern non-human identities in AI-heavy environments?
A: Teams should govern non-human identities the same way they govern other privileged assets: assign ownership, minimise scope, rotate credentials regularly, and monitor for abnormal use.
Q: Why do agentic AI systems change IAM risk?
A: They change risk because they can move from observation to execution.
Q: What are the signs that identity governance is not working in practice?
A: Common warning signs are repeated access workarounds, ignored approval workflows, super admins holding too much power, and teams bypassing the process because it is too slow or hard to use.
Practitioner guidance
- Inventory non-human identities continuously Map every service account, token, bot, workload and API credential to an owner, purpose and expiry condition.
- Tie privileged access to behaviour signals Use SIEM and identity telemetry to trigger step-up controls or removal when access patterns become anomalous, especially for privileged identities spanning cloud and on-premises systems.
- Replace static review cadences with time-bounded access Set access to expire by default and require re-authorisation at the point of use for higher-risk systems, rather than depending on quarterly or annual certification alone.
Bottom line: NHI growth and agentic AI are combining to strain identity governance models that were built around slower human access patterns.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
08/10/2026 4:55 pm
NHI sprawl is now a governance scaling problem, not an inventory nuisance. When non-human identities outnumber people by orders of magnitude, the issue is no longer how to manage accounts one by one. The real failure is that identity governance processes were designed for a far smaller and more stable population. Practitioners should treat NHI growth as a lifecycle and ownership problem, not just a security tooling problem.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
- 59% of organisations say they lack viable alternatives to standing privileged access for NHIs and AI agents, according to Delinea research.
A question worth separating out:
Q: How should security teams implement Zero Trust for NHIs and AI systems?
A: Start by mapping effective access to sensitive data, not just configured permissions. Then classify the data, reduce standing privilege, and require runtime context such as workload posture, request type, and current risk before granting access. The goal is to keep machine identities inside a narrow, reviewable blast radius.
👉 Read our full editorial: Agentic AI and NHI sprawl are forcing IAM governance to adapt