Welcome to the latest edition of our Non-Human & AI Identity Journal where we cover:   

• NHI Mgmt Group at BlackHat
• Our pick from our Non-Human & AI Identity Forum 
• Recent Breaches and Security Incidents 
• Upcoming Events, Webinars, Industry Announcements 

The Non-Human & AI Identity Podcast 

Recorded at Black Hat this week, Mr NHI puts two security leaders in the Hot Seat for a rapid-fire round on Identity Security. As autonomous agents flood enterprise environments, the focus shifts from deployment speed to securing AI systems and managing machine identities at scale.

Howard Ting, CEO of Opal Security – view the recording here.

Diana Jovin, CMO at Teleport – view the recording here.

Recent NHI & Identity Security Breaches 

Gravity SMTP CVE-2026-4020: A Single HTTP Request Exposed API Keys Across 100,000 WordPress Sites 

Between May and June 2026, attackers exploited a critical vulnerability in the Gravity SMTP WordPress plugin, tracked as CVE-2026-4020, to harvest live API keys, OAuth tokens, and service credentials from approximately 100,000 websites using a single HTTP GET request. This vulnerability allowed unauthenticated access to sensitive credentials, highlighting the critical importance for security professionals to ensure robust permission checks and timely patching of plugins. The breach underscores the necessity for continuous monitoring and the implementation of protective measures like firewalls to mitigate automated exploitation efforts. 

Non-Human and AI Identity Forum Posts 

Our suggested reading for this week from our forum — with over 16,300 articles about NHIs, including Agentic AI. 

• Inside the 48-Hour Supply Chain Attack Spree Across npm, PyPI, and Docker Hub — GitGuardian 

• Agentic runtime authorisation: what IAM teams need to govern now — P0 Security 

• IAM hygiene and recertification backlogs: what teams need to fix — Nexis 

• AI agent identity risk in vendor environments: what changed? — Unosecur 

• Authn and authz are diverging under modern IAM pressure — Opal Security 

• IAM vs PAM: Key Differences You Need to Know — Arcon 

• Adaptive trust and conditional trust: where IAM teams are hitting limits — Clarity Security 

• AI agent access governance: why transformation stalls at the gate — C1.ai 

• Doppler alternatives: where secrets management stops and identity governance starts — Akeyless 

• Onboarding as code: what it means for IAM teams — Saviynt 

• Static credentials in banking infrastructure: what changes with certificates? — Teleport 

• Lockstep dual control for identity actions: what changes for IAM teams? — Scramble ID 

• Disconnected applications and Agentic IGA: is your IAM coverage complete? — StackBob 

Latest Industry Announcements 

Major updates shaping the NHI and identity security space this week: 

• C1.ai: AI agent identity risk is outpacing manual review controls 

• Akeyless: OpenAI Codex and secretless access: what IAM teams need to know 

• Saviynt: AI identity security: are your controls ready for agents and NHI? 

• P0 Security: Agentic workforce access controls: are your runtime policies keeping up? 

• Opal Security: Access comparison for outlier access: is continuous review enough? 

• Linx Security: Agentic AI access control in Snowflake: are your controls ready? 

• Commvault: AI agent sprawl and recovery gaps: what governance teams miss 

• PlainID: Real-time authorization at sign-in: what changes for IAM teams? 

Upcoming Events and Webinars 

To support your learning journey, here are key events happening across the industry. They feature experts discussing the latest challenges and innovations in identity security: 

• SecureWorld Atlanta 2026: what runtime authorization means for NHIs — by P0 Security 

• Developer endpoint secrets on November 18, 2026: what changes now? — by GitGuardian 

• Gartner IAM Summit 2026: what does it mean for identity teams? — by Bitwarden 

• AI-driven loyalty programmes: what happens when IT queues fall behind? — by Comarch 

• AI agent regulation on July 30: what should security teams prepare? — by Zenity 

• Kong Developer Summit 2026 in Los Angeles: what IAM teams should watch — by Kong 

• Trust infrastructure on February 23, 2027: what IAM teams need now — by Keyfactor 

• AI token usage and governance gaps: what should teams do now? — by 1Password 

• Phishing at scale for mid-market firms: what changes for defence? — by Abnormal AI 

The Most Comprehensive & Only CPD-Certified NHI Course 

Our CPD Certified NHI Foundation Level course delivers practical guidance on governing, managing, and securing NHIs, including AI agents. Developed by Mr NHI, it’s designed for beginners, security professionals, and IT leaders, with hundreds of learners and an average 5-star rating. 

Enroll here. 

Are you planning a NHI Program in 2026 including Agentic AI? 

As the premier authority on Non-Human Identities, with over 20 years of hands-on experience managing $10M–$20M+ global NHI programs, we offer independent guidance and advice tailored to your needs. Our expertise spans risk and maturity assessments, program initiation and hands-on execution, ensuring your organisation stays ahead of evolving threats and maximises risk reduction. 

Reach out here for a free initial consultation. 

Lalit Choda 

Founder of the NHI Mgmt Group