At a glance
- Non-human identities (NHIs), such as service accounts, CI/CD jobs, bots, API keys and AI agents, far outnumber people.
- They hold deep, privileged access, but often have no owner, no expiry and no audit trail.
- The biggest NHI security gaps: no inventory, unmanaged service accounts, secrets in config files and IAM built for humans.
- Non-human identity security is a governance problem: inventory, ownership, scoped access and automatic expiry.
Most security teams have focused their identity governance efforts on managing human access.
You’ve got SSO in place. MFA is enforced. There’s a reasonably consistent process for onboarding and offboarding employees. You probably run access reviews on a quarterly basis and, if you’re further along, maybe you’ve deployed a PAM solution to protect privileged user accounts.
This is the result of a decade of hard-won maturity. Human identity governance has been steadily improving. Non-human identity security has not kept pace, and that is the gap attackers are now working through.
But the next identity breach won’t come from a compromised human password.
It will come from a machine compromise. Here’s why!
The cloud’s most overlooked attack surface
In today’s cloud environments, machines, or non-human identities, vastly outnumber humans. CyberArk’s 2025 Identity Security Landscape, a survey of 2,600 security decision makers, estimates 82 machine identities for every human in organizations worldwide.
These aren’t hypothetical “machines.” They’re everywhere: CI/CD jobs that deploy dozens of times a day. Terraform plans that provision infrastructure. Service accounts attached to containers. Bots that run scheduled tasks. AI agents that are starting to proliferate.
These identities are operational. They’re invisible to most security workflows. And they’re dangerously over-permissioned. Worse, most of them don’t have owners. Or expiration dates. Or audit trails.
But they do have access, often deep, privileged access, to production systems, secrets and sensitive data. And when compromised, they don’t behave like humans. They don’t try to log in. They don’t get locked out. They stealthily maintain steady access.
From headline risk to daily reality
This is no longer a theoretical concern. It’s a real pattern and it’s accelerating.
The Non-Human Identity Management Group has catalogued 52 real-world NHI breaches, with new incidents added monthly. From Microsoft to Snowflake, these documented cases show that machine identity compromise has become the preferred attack vector, precisely because these credentials operate below the radar of most security tools.
In December 2024, BeyondTrust was breached via a compromised API key. The incident affected U.S. Treasury systems, not because someone clicked a phishing email, but because a credential issued to a machine was compromised, quietly and without detection.
In February 2025, attackers alleged they had exfiltrated credentials from Cisco’s Windows Active Directory environment, a claim Cisco disputed, saying the data came from an earlier incident.
What’s striking is not that these companies were targeted. It’s that the compromise didn’t involve novel exploits or complex tactics. It involved something every company has: stale, unmanaged machine access.
According to the Cloud Security Alliance’s State of Non-Human Identity Security report (September 2024, commissioned by Astrix), only 15% of organizations feel highly confident in preventing NHI attacks, while 69% express concerns about them. And they should be, because attackers have already figured out that machine identities are easier to exploit and harder to detect when compromised.
Why traditional IAM tools are failing
Most IAM tools were built around humans. Their assumptions are logical, for humans. They expect a user to log in. They track sessions. They define roles based on departments or titles. They assume access is assigned manually and reviewed periodically.
But NHIs don’t operate that way.
Machine identities don’t request access. They’re provisioned automatically, often by scripts or orchestration tools. Their credentials are embedded in config files, hardcoded into environments, or issued through vaults that don’t track usage or expiration. These credentials don’t get revoked when no longer needed. They often aren’t rotated, and when they are, it’s a manual process tied to a checklist someone eventually forgets.
There’s no built-in notion of ownership. No approval workflow. No expiration policy.
And when you ask basic questions (Who owns this service account? What is it allowed to do? When was it last used?), you usually get shrugs, or a spreadsheet last updated months ago by someone who no longer works at the company.
That’s a significant governance gap. And it’s growing.
NHI security gaps, and how to close them
The NHI security risks above come down to six gaps, and each one maps to a fix from the governance frame later in this piece.
| Gap | What it looks like | How to close it |
| No inventory | NHIs created by scripts and pipelines that no one tracks | Continuously discover every NHI across clouds |
| No owner | No one can answer “Who owns this service account?” | Assign ownership and accountability |
| Unmanaged service accounts | Stale accounts with admin rights that are never offboarded; CSA found only 20% of organizations have formal processes for offboarding and revoking API keys | Expire, rotate or revoke automatically when context changes |
| Over-broad scope | Permissions granted for convenience, not intent | Define scopes that match the job’s intent |
| Static secrets | Credentials embedded in config files and environments | Issue short-lived credentials tied to job completion |
| No usage monitoring | A compromised identity moves laterally undetected | Monitor active usage, not just credential issuance |
Every identity is a pivot point
Think about what a compromised machine identity enables.
It doesn’t need to be authenticated at the front door. It already has access to what it needs.
It can move laterally across environments. It can extract data, act with the privileges of a trusted service, or modify infrastructure. And unless you’re actively monitoring usage, not just credential issuance, you may not notice anything until long after the damage is done.
In this way, every non-human identity is a potential pivot point: a way for attackers to leap from one system to another, undetected.
And yet, most organizations are still focused on governing human access. They’re locking down user accounts while leaving tens of thousands of machine identities wide open, operating on blind trust and inertia.
This isn’t just a visibility pain: it’s a governance problem
You can’t solve this with better alerts. Visibility alone doesn’t solve for ownership, lifecycle, or policy enforcement. And while tools like vaults are great for secret storage, they weren’t built to answer access questions, or support today’s (modern) cloud infrastructure.
What you need is a way to govern machine identities the same way you’ve learned to govern human ones:
- Inventory them comprehensively
- Assign ownership and accountability
- Define scopes and permissions that match intent
- Automatically expire, rotate, or revoke credentials when context changes
This may sound daunting, but implementing these controls are a critical piece of your IGA program.
The shift that’s already happening
The most forward-thinking teams I’ve worked with have already started making this shift.
They no longer treat service accounts as permanent infrastructure. They treat them as ephemeral, policy-bound identities. They’ve begun mapping their machine identities, tagging owners and enforcing expiration dates on credentials. In some cases, they’ve moved to short-lived credentials that are issued only when needed and vanish once a job completes.
This is the future of least privilege.
Not just “knowing who has access,” but actively controlling what they can do, for how long and under what conditions, for both human AND non-human identities.
Non-human identity best practices
Securing non-human identities starts with six practices. Part 2 of this series covers how to put them in place.
- Inventory every service account, bot, pipeline, API key and agent continuously, as part of NHI lifecycle management.
- Tag an owner to each NHI and review ownership when teams change.
- Scope permissions to the job, not the convenience of the person who created it.
- Replace static keys with short-lived credentials issued per job through just-in-time access.
- Expire, rotate and revoke automatically, and offboard unused accounts on the way to zero standing privilege.
- Monitor actual usage to spot pivots and dormant access.
Key takeaways
- Human identity governance has matured; non-human identity security has not.
- Machine identities now outnumber people and often hold privileged, unowned access.
- Documented incidents, including the December 2024 BeyondTrust API key compromise, show the risk is already here.
- IAM built for humans misses NHIs: no sessions, no owners, no expiry.
- Closing NHI security gaps is a governance job: inventory, ownership, scope and automatic expiry.
What’s next
Part 2 of this series, Beyond Humans: Governing Machine Identity Access at Scale, goes deeper into what NHI governance actually looks like, from real-world inventory strategies to policy enforcement patterns, all the way through automation and orchestration.
Because this problem won’t be solved with better spreadsheets or bigger vaults. It will be solved by treating machine access with the same discipline we’ve learnt to apply to humans, which, even after all these years, is still an ongoing process, especially in modern/cloud environments.
And it starts with acknowledging the truth: Machines have never been truly factored into your identity governance strategy.
Visit www.P0.dev to learn more about how to secure access lifecycles for every identity.
Frequently asked questions
Why do non-human identities now outnumber human identities in the enterprise?
Non-human identities now outnumber human identities in the enterprise because every service, integration, and automated workflow spins up its own accounts and API keys.
What hidden risks do unmanaged non-human identities create for cloud security?
Unmanaged non-human identities create hidden risk by holding broad, long-lived permissions that rarely get reviewed or rotated, unlike human user accounts.
How do you discover and govern the full inventory of non-human identities?
Teams discover and govern the full inventory of non-human identities by using automated tools that continuously scan for service accounts, API keys, and agents across the cloud.
How does P0 Security enforce least privilege and credential rotation for NHIs?
P0 Security enforces least privilege and credential rotation for NHIs by automating discovery and right-sizing permissions instead of relying on manual audits.
What are the biggest NHI security risks?
The biggest NHI security risks are unmanaged service accounts that are never offboarded, over-broad permissions granted for convenience, static secrets embedded in config files and a lack of usage monitoring that lets a compromised identity move laterally undetected.
How many non-human identities does the average enterprise have?
Estimates vary by source, but CyberArk’s 2025 Identity Security Landscape puts it at 82 machine identities for every human in organizations worldwide, based on a survey of 2,600 security decision makers.