Non-Human & AI Identity Threats in Cyber Security

As organisations move to cloud-native architectures, automation and zero-trust models, NHI exploitation has become the #1 identity threat. APIs, service accounts, machine identities, cloud workloads and cryptographic credentials outnumber human identities and often hold high-privilege access, making them a prime target.

Leaks keep growing: GitGuardian counted 28.65 million new hard-coded secrets on public GitHub in 2025 alone, up 34% in a year, and 64% of valid secrets found in 2022 were still active in January 2026. And compromise is fast: in many cases a skilled attacker needs less than a minute to take over an unmanaged NHI, setting off a chain reaction across systems.

• Easy to discover and compromise — Weak configurations and poor identity management across systems and networks.
• A gateway to supply-chain attacks — Compromised NHIs at third-party vendors give attackers a backdoor into enterprises — as stolen OAuth tokens from the Salesloft Drift integration showed in August 2025.
• Silent lateral movement — Compromised NHIs let attackers move and persist without the signals human accounts give.

Tackle it with: Detection & Response · Secretless Credentials

A traditional service account does one predictable job. An AI agent decides what to do next: it plans, calls tools and APIs, reads and writes data, and can hand work to other agents. Its access is delegated from people and systems, often broader than the task needs, and exercised without a human approving each step.

• Delegated, chained access — An agent acting for a user or another agent can combine their permissions in unexpected ways.
• Unpredictable behaviour — The same agent can take different paths on different days, which breaks static access rules.
• Accountability gaps — Logs show the credential that acted — not always which agent, prompt or person was behind it.

Tackle it with: Classification & Ownership · Preventive Controls

NHIs are now the largest attack surface in modern IT environments, yet their controls remain weak. Many organisations fail to track or enforce NHI security policies at all.

• Inadequate lifecycle management — NHIs created with no expiry or decommissioning plan, leaving stale identities behind.
• Excessive privileges — Far more access than needed, broadening the attack surface.
• No environment segregation — The same NHI — or the same password — used in production and non-production.
• Plain-text credentials — Secrets hard-coded in repositories and other places attackers can find them.
• No credential rotation — Long-lived credentials that increase the risk of compromise over time.
• Standing access — Permissions that are always on, rather than granted just in time for the task.

Tackle it with: Posture Management · Secretless Credentials

Machine identities such as service accounts, API keys and tokens operate behind the scenes with elevated privileges and minimal monitoring, making them prime targets.

Salesloft Drift (August 2025): OAuth tokens stolen from the Drift chat integration were used to export data from customers' Salesforce instances, which the attacker then searched for more credentials such as cloud keys and passwords. BeyondTrust (December 2024): a compromised API key was used to access certain customer instances of its Remote Support SaaS platform.

Tackle it with: Secretless Credentials · Detection & Response

Explore 150+ NHI & AI agent breaches →