Topic starter
07/03/2026 1:31 am
TL;DR: Non-human identities now outnumber employees by 25x to 50x in modern enterprises, and the article argues that service accounts, OAuth tokens, API keys, certificates, and AI agents sit outside the lifecycle assumptions built into traditional IAM, according to Obsidian Security. The governance gap is now operational, not theoretical, because machine credentials bypass MFA and persist without human-style oversight.
Editorial analysis by NHI Mgmt Group, based on content published by Obsidian Security: “What Are Non-Human Identities? The Complete Guide to NHI Security”.
By the numbers:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
Key questions
Q: What breaks when non-human identities are managed outside the IAM operating model?
A: What breaks is accountability.
Q: Why do service accounts and tokens create more risk than many teams expect?
A: Because they often carry standing privilege, operate quietly, and remain valid long after the business need changes.
Q: What are the signs that non-human identity governance is starting to slip?
A: Warning signs include reliance on manual upgrade paths, ad hoc secret handling, and fragmented access management across tools and environments.
Practitioner guidance
- Define an NHI ownership model Assign a named business or technical owner to every service account, token, key, certificate, and AI agent credential so no machine identity exists without accountable stewardship.
- Map credential lifecycles end to end Track issuance, scope, rotation, reuse, revocation, and offboarding for machine identities across SaaS, cloud, CI/CD, and third-party integrations.
- Replace human-style reviews with NHI-specific controls Stop relying on quarterly access certification alone and add continuous monitoring for unused credentials, overprivileged scopes, and inherited third-party access.
Bottom line: The article frames non-human identities as a structural mismatch for traditional IAM, not a niche exception to be absorbed into human processes.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
08/10/2026 4:39 pm
Traditional IAM is now a partial control plane, not a complete identity model: Human lifecycle governance still matters, but it no longer covers the identities that actually drive modern access paths. Service accounts, OAuth tokens, and machine credentials create authority without the human ownership assumptions IAM was built around. The implication is that identity architecture has to separate person governance from machine governance instead of treating them as one programme.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should teams prioritise NHI inventory or behavioural detection first?
A: Behavioural detection should move up the list as soon as the environment contains active SaaS integrations or reused credentials. Inventory is necessary, but it cannot show abuse, lateral movement, or unexpected trust-path changes on its own. Teams need both, with detection covering the blind spots that inventory cannot see.
👉 Read our full editorial: Why traditional IAM breaks down for non-human identities