History was created as our NHI Mgmt Group co-hosted the first ever Global NHI Summit at the iconic Nasdaq Marketsite venue in NY on 27th Feb 2025 with Entro Security.
We also used the event to launch our new Logo and Branding, including replacing our iconic t-shirt.
We had 20 industry leading speakers, 11 sponsors and over 200 participants in attendance from all industries, with an amazing agenda, that on the whole, providing thought provoking insights around Non-Human Identities.
Opening Remarks by Itzik Alvas and Lalit Choda (Mr. NHI)
It was a huge honour and privilege to share opening remarks, to kick-off the historic, first of it’s kind #NHIGlobalSummit.
After introducing #MrNHI and our NHI Mgmt Group, I welcomed everyone to the event, thanked our sponsors :
- Akeyless Security, Twine Security, Andromeda Security, P0 Security, SlashID, Axiom Security, BHI, Aembit, Britive
and our guest speakers :
- Olivia Phillips, Nirit Icekson, Daniel Cohen, Rahul Bhardwaj, Omri Green, John Remo, Larry Whiteside Jr., Oded Hareven, Kamal Congevaram Muralidharan, Christopher Cutajar, Nathan Shuchami, Itay Mesika, Harnit Singh, Mario Duarte, Vincenzo Iozzo, Artyom Poghosyan, Francis Odum, James J Azar, Adam Cheriki
and finally thanks our NHI Mgmt Group and Entro Security teams, that worked tirelessly over the last 3 months to plan the event, including all the logistics, marketing etc that resulted in massive interest within the industry, with approx. 300 folks registering for the event.
I shared insights on what to expect during the day and explained why this is the hardest risk you will probably tackle in your career, given the very weak controls around NHIs and that it impacts all your IT processes and teams.
I went on to cover “Why Now”, due to Hyper Fragmentation, with Multi-Cloud, On-Prem, SaaS, Microservices, Containerisation, GenAI we have a huge Secrets Sprawl problem, NHIs are easy to discover, Breaches occurring on a regular basis. I also share that this is not just a external Cyber threat, but a huge Internal threat also.
Finally I asked the audience 3 questions
- how many are very concerned about NHI risks?
- how many know how to fully address NHI risks?
- how many are actively pursuing a NHI program currently?
Watch the full video here of my opening remarks.
Panel: 2024 – 2025 NHI Stats that will Blow your Human Mind
Moderated by: Lalit Choda, Founder, Non-Human Identity Management Group
Panellists:
- Daniel Cohen, Senior Vice President, Enterprise Security Architecture & Capabilities, Paramount
- Itzik Alvas, CEO & Co-founder, Entro Security
- Rahul Bhardwaj, Vice President – Cyber and Data Privacy, Head Information Security – Americas, EXL
- Itay Mesika, CEO and Co-founder, Axiom
Lalit Choda introduces the session by highlighting the most comprehensive ground-breaking research report that he published in January 20205 “The Ultimate Guide To Non-Human Identities“, where in one chapter there was a deep dive on major research and surveys conducted by the Non-Human Identity Mgmt Group and other organisations. Four mind blowing NHI were pulled out of this report and discussed by the panel :
- Stat 1 – Secrets Sprawl – A staggering 12.8 million occurrences of secrets were detected on GitHub.com in 2023
- Stat 2 – NHI Breaches – 66% of enterprises enduring a successful cyber attack from compromised NHUIs
- Stat 3 – Addressing NHI Risks – 68% of respondents said they don’t know how to fully address Non-Human Identity risks
- Stat 4 – Mismanaged NHIs – 97% of NHIs have excessive privileges increasing unauthorised access and broadening the attack surface
Some great insights from the panel that brought home to the audience the huge exposure and challenges around managing and securing NHIs.
This is due to :– many NHIs being static in nature; huge secrets sprawl problem from hyper fragmentation; weak or non-existent lifestyle processes; easy discovery and compromise- excessive privileges; breaches seen on a regular basis including 3rd party supply chains.
You can view the full presentation here.
Best Practices for NHI Security: What do I Prioritize
Kamal Congevaram Muralidharan (Co-founder and Chief Technologist, Andromeda Security) delivered a talk on Best Practices for NHI Security, highlighting the importance of entitlements for non-human security.
He recommended the following NHI Security best practices:-
- Use short-lived credentials whenever possible to reduce risk
- Dynamically evaluate and right size entitlements to least privilege to minimize the attack surface
- Use behavioural analysis to detect anomalies and identity compromises
The VC Perspective: Why We Decided to Invest in an NHI Company
Nathan Shuchami (Managing Partner, Hyperwise) shared fascinating insights on how a VC firm operates, how it evaluates companies to invest in and why they chose to invest in a NHI company.
In terms of 5 leading investment criteria :
- The CEO
- Organic sales skills from day zero
- Solving real material and immediate problem
- MVP in 8 months from seed funding
- High barrier to entry, yet feasible solution
What they look for in Cybersecurity Founders
- Deep Domain Expertise
- Hands On Practitioner Experience
- Vision and Adaptability
- Ability to Execute
- Market Validation and Seamless Adoption
- Relentless Passion and Persistence
Defending Against Identity Breaches: A Comprehensive Taxonomy of Attacker TTPs and How to Stop Them
Vincenzo Iozzo (Founder & CEO, SlashID) shared amazing insights on attackers tactics, techniques and procedures (TTPs) and how you can stop them
- 79% of attacks today are malware free
- 31% of all breaches involve stolen credentials
- +583% increase in kerberoasting attacks YoY
- 66% of AWS breaches are caused by leaked/stolen credentials
Vincenzo explained the anatomy of a breach
- Phishing or Credential Lead -> Initial Compromise -> Credential Harvesting -> Data Exfiltration
and the root causes
- Stateless tokens
- Complex protocols
- Broken permission models
Finally he spoke about how to defence against these attacks
- Identity attacks don’t target only NHIS -> need to cover human identities also
- Posture, lifecycle management and PAM are not enough -> ITDR capabilities are key to reduce dwell time
- IdP audit logs have partial visibility -> need a comprehensive view of your environment
- MFA and FIDO are not enough – attackers get around both -> ITDR + device bound tokens
- Over-permissioned and long-lived identities make lateral movement trivial -> migrate to JIT access
Fireside chat: Managing the full-lifecycle of Secrets & Non-Human Identities
Oded Hareven (CEO and Co-founder, Akeyless) and James J Azar (CISO at AP4 Group & Host of the CyberHub Podcast) highlighted how reducing secrets and leveraging #SPIFFE, #SPIRE, and #OIDC tokens helps shrink the attack surface.
Less secrets, more security!
One great discussion was around the different generations or maturity of NHI Management – Oded shared that with most clients at the moment the focus is protecting the credentials (secrets)
- 1st Gen – Static secrets are the core issue at most orgs and the initial focus is the need to get them secured e.g. in a secrets vault, to reduce discovery etc.
- 2nd Gen – Rotation tends to be the next generation or focus, however it isnot bring implemented as much as it should have been, even though regulators and auditors expect this to happen – why because it’s very hard to rotate without potentially causing operational impact.
- 3rd Gen – moving on from rotation, and using Just-In-Time (JIT) credentials and temporary identities
The Human Journey to Managing NHIs: Lessons from a CISO on the Frontline
Mario Duarte (Chief Information Security Officer, Aembit & Former CISO of Snowflake) gave fascinating insights, having previously been CISO at Snowflake.
- 60% of CISOs in publicly traded companies state that IAM is a function owned by their team
- 65% of CISOs in privately held companies state that IAM is a function owned by their team
- Human errors are the cause of the majority of major security breaches in the past 20 years – from weak passwords and poor credential management, phishing attacks, misconfigured system and security settings, unpatched software, unauthorised software and shadow IT
- Human IAM solutions like MFA FIDO2, Zero Trust etc have created more secure access and made users lives better and more productive
- Same goals required for Non-Human Identities – find solutions that improve the overall security posture; help everyone become more productive
- What were the root causes from a huge breach : found issues/anomalies with software accessing the most sensitive systems (and there were a lot of them); monitoring and alerting wasn’t good enough; Devs were left with a terrible experience managing secrets
- By deploying Non-Human IAM you will achieve : proactive practices with automation; better developer experience, multiplier effect when integrating NHI IAM with existing security tools
Fireside chat: When AI Agents Manage NHI’s
Omri Green (Co-founder and GTM, Twine Security) hosted a fireside chat on the main stage with Yuval Malisov (Chief Information Security Officer, BHI), where we discussed the opportunities in #AgenticAI for the #cybersecurity industry for the financial sector and beyond.
With Deloitte’s forecasts that 25% of enterprises will deploy AI agents by 2025, growing to 50% by 2027, the message is clear: adapt or fall behind.
For financial institutions, this means:
- Building clear operational boundaries with AI
- Balancing productivity gains against regulatory requirements
- Implementing governance before deployment, not after
- The next step in evolution is AI employees that mimic human problem-solving abilities.
For CISOs and cyber teams, this means:
- Shifting entire workloads to AI systems
- Finally taking the strategic view they’ve been too overburdened to achieve
- Focusing on high-value decision making instead of routine operations
- When thinking about Identity, AI employees are set to augment the teams with:
- Handling day to day tasks, like Access Requests
- Finding missing owners of Non Human Identities
- Making sense of the complex entitlements, so humans can make informed decisions.
Are you developing your strategy around AI, and embrace the wave, or will you be playing catch-up when your competitors gain the advantage?
Panel: The Challenges and Opportunities of Securing NHIs in the Modern Enterprise
Moderated by: Larry Whiteside Jr., Co-founder and President Confide
Panellists:
- Olivia Phillips, Business Information Security Officer, Amtrak
- Harnit Singh, Founding Product Manager, P0 Security
- Art Poghosyan, CEO & Co-Founder, Britive
Larry Whiteside Jr. hosted an entertaining discussion with Olivia Phillips , Artyom Poghosyan and Harnit Singh on the challenges and opportunities of securing NHIs in the modern enterprise.
Case Study: I Was Breached and Lived to Tell – How to Handle an NHI Attack
John Remo (CEO and Co-founder, Arbitium) spoke shared fascinating insights about a major breach, that left an organisation with unauthorised data access, extended breach duration and regulatory and legal consequences.
What Went wrong :
- Inadequate Monitoring of NHIs
- Lack of Secure credential management
- Absence of Least Privilege
- Insufficient Lifecyle Management
Why Non-Human Identity Management matters so much?
- Expanding Attack Surface
- Complexity of Access Controls
- Automation and Scale
- Regulatory Compliance
- Reputation and Trust
Breach Implications
- Cost of reimbursement for any damages / class action lawsuits
- Crisis communication and public relations
- Legal & Regulatory Compliance – inside and outside USA (more strict)
- 3rd Party Supply Chain Risks
- Internal & External Customer / Stakeholder Trust
Why I Implemented a Solution: Lessons from a Security Engineer on the Frontlines
Christopher Cutajar (Principal Information Security Engineer, Elastic) shared lessons learned :
- Get Leadership Onboard – need executive buy in
- Finding Owners is Hard and very time consuming
- Take a Data Driven Approach to get visibility
- Automation Helps at Scaling
- Create User Empathy e.g. through pilot groups
- Work as a Team to help with this huge challenge that spans all IT groups/processes
NHI Analyst Review: Market Trends, Risks & Opportunities
Francis Odum (Founder Software Analyst Cybersecurity Research) shared key market trends :
- Vendor Proliferation
- Cloud NHIs & Microservices
- Machine PKI & Certificates Mgmt
- API Explosion
- Compliance & Regulatory Drivers
Drinks & Networking
- The most important part of the day
