Topic starter
06/07/2026 9:38 am
TL;DR: Enterprises now have non-human identities outnumbering humans by more than 45:1 in some environments, while attackers continue to exploit compromised NHIs in major breaches, according to Token Security. The governance gap is structural: IAM programmes built for people do not reliably control machine-native identities or autonomous agents.
Editorial analysis by NHI Mgmt Group, based on content published by Token Security: “Why We Backed Token Security: Securing Non-Human Identities for the Agentic AI Era”.
By the numbers:
- NHIs outnumber humans by more than 45:1 in some enterprises.
Key questions
Q: What breaks when non-human identities are governed like human users?
A: Lifecycle triggers, ownership, and review processes stop working because machine identities do not generate joiner, mover, or leaver events.
Q: Why do service accounts and AI agents need different controls from human users?
A: Service accounts and AI agents authenticate and act without the predictable patterns that human identity systems expect.
Q: How should teams detect NHI abuse before it becomes a breach?
A: Teams should watch for anomalous API calls, secrets abuse, and privilege drift rather than relying on human-login signals.
Practitioner guidance
- Map each NHI to origin and purpose Link service accounts, APIs, workloads, and ephemeral processes back to source code, IaC templates, and business purpose so you can identify orphaned access and ownership gaps.
- Tie deprovisioning to runtime lifecycle events Remove entitlements when the workload, deployment, or agent task ends, rather than waiting for a manual review cycle that may never catch short-lived identities.
- Separate machine telemetry from human IAM telemetry Build detections for anomalous API calls, secrets abuse, and privilege creep because interactive-login signals will not reliably cover machine-native misuse.
Bottom line: The article shows that the main security problem is not just identity sprawl but weak governance over machine-native access that was never designed for people-centric IAM.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/07/2026 9:53 am
NHI governance is becoming the control layer for agentic AI. The article is right to frame non-human identity as the larger, less governed population behind modern infrastructure. When identities are created dynamically, persist beyond their task, and accumulate privilege, IAM for people cannot absorb the resulting scale or speed. The practitioner implication is that NHI governance must be treated as a primary operating layer, not a secondary hygiene task.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: When should teams prioritise NHI governance over other IAM work?
A: Teams should prioritise it when automation, cloud integrations, or AI agents are expanding faster than identity review processes. If service accounts and secrets are not fully inventoried, the organisation is already exposed. Governance should move up the queue whenever audit readiness, least privilege, or incident response depends on machine identities.
👉 Read our full editorial: Non-human identity governance is becoming the agentic AI control layer