Notifications
Clear all
Topic starter
06/07/2026 9:38 am
TL;DR: Enterprises now have non-human identities outnumbering humans by more than 45:1 in some environments, while attackers continue to exploit compromised NHIs in major breaches, according to Token Security. The governance gap is structural: IAM programmes built for people do not reliably control machine-native identities or autonomous agents.
NHIMG editorial — based on content published by Token Security: Why We Backed Token Security: Securing Non-Human Identities for the Agentic AI Era
By the numbers:
- Non-human identities outnumber humans by more than 45:1 in some enterprises.
Questions worth separating out
Q: What breaks when non-human identities are created without lifecycle ownership?
A: When non-human identities lack lifecycle ownership, they persist beyond the workload, integration, or vendor relationship that created them.
Q: Why do NHIs complicate traditional IAM programmes?
A: NHIs complicate traditional IAM because they do not behave like employees.
Q: What do security teams get wrong about machine identity risk?
A: Security teams often focus on the number of machine identities instead of the quality of their governance.
Practitioner guidance
- Inventory machine identities by provenance Link each service account, API credential, and workload identity back to its source code, IaC template, or control owner so that every identity has an accountable parent.
- Make lifecycle offboarding mandatory for NHIs Build revocation steps into workload retirement, pipeline teardown, and vendor change processes so access does not survive the process that justified it.
- Replace human IAM signals with machine-specific detections Tune monitoring for anomalous API calls, unusual secrets use, and unexpected workload-to-workload relationships instead of login-centric alerting.
What's in the full article
Token Security's full blog covers the operational detail this post intentionally leaves for the source:
- How Token Security maps identities back to source code and IaC templates in its risk graph.
- The platform workflow for lifecycle governance, compliance reporting, posture management, and remediation.
- Machine-native detection examples for anomalous API calls and secrets abuse in live environments.
- The way automated response is integrated with SIEM, SOAR, and XDR for operational teams.
👉 Read Token Security's analysis of NHI security in the agentic AI era →
NHI governance and agentic AI access risk: what teams need now?
Explore further
06/07/2026 9:53 am
NHI governance is no longer a side discipline inside IAM. It is the control layer that determines whether machine access remains attributable, reviewable, and revocable at enterprise scale. Token Security’s thesis reflects what many security teams are now seeing in practice: NHIs are larger than human populations and often less governed. When that is true, human-centric access models stop being the primary control plane and become only one part of the programme. Practitioners should treat NHI governance as a first-order architecture concern.
A few things that frame the scale:
- 88.5% of organisations acknowledge that their non-human IAM practices lag behind or are merely on par with their human identity and access management efforts, according to The 2024 Non-Human Identity Security Report.
- Only 19.6% of security professionals express strong confidence in their organisation's ability to securely manage non-human workload identities, which underscores how thin the operational margin remains.
A question worth separating out:
Q: How should organisations govern NHIs alongside human IAM?
A: Organisations should govern NHIs as a separate but connected identity population with its own lifecycle, ownership, and monitoring model. That means linking machine access to source systems, enforcing deprovisioning, and using detections that reflect machine behaviour. Human IAM and NHI governance need shared oversight, not shared assumptions.
👉 Read our full editorial: Non-human identity governance is becoming the agentic AI control layer
