How can the growing Non-Human ID growth and governance gap be capped? 

We have already talked about machine IDs. In this blog, we zoom out and focus on Non-Human IDs (NHIs). Both types of IDs share another similarity: there are just way too many of them. NHI secrets, including API keys, service accounts, and Kubernetes workers, now outnumber human identities by at least 45-to-1 in DevOps environments. outnumber human identities by at least 45-to-1 in DevOps environments. And how much is too much, considering that APIs, containers, service accounts, bots, IoT devices, AI agents, and automated pipelines all rely on digital identities to function? This is a nightmare situation, as governance practices have not evolved at the same pace, and managing them can be a problem.  This widening gap between identity growth and identity governance is a serious risk, and if not tackled in time, has the potential to devolve into a disaster. 

The explosive growth of NHIs is driven by several technology shifts. The move to cloud-native architectures has led to monolithic applications segmented into microservices that constantly “talk” with one another. Each of these services requires its own identity to authenticate and authorize requests. At the same time, enterprises are adopting API-first strategies, exposing internal and external capabilities through programmable interfaces. Every integration partner, application, and automation tool requires its own credentials, which inevitably leads to a proliferation of API tokens and secrets. DevOps practices further amplify this trend, as pipelines, automation scripts, and infrastructure-as-code tools rely on service accounts to access repositories, cloud environments, and production systems. More recently, the emergence of AI-driven agents and autonomous workflows has introduced a new class of non-human identities. These are entities that not only execute tasks, but also make decisions and initiate actions independently, and as is the way, introduce new risks. 

Traditional service accounts follow scripts or fixed workflows. Their behavior is known, and their actions can be constrained by tightly defined permissions. Unlike this, AI agents interpret data dynamically, make real-time decisions, and initiate actions across multiple systems. For example, an AI-driven customer service agent may access CRM data, update customer records, trigger refunds, and interact with billing or logistics systems. Each of these actions requires access rights, and the agent’s behavior may vary depending on context, prompts, or incoming data. This makes it harder to predict or constrain what the identity might do. A rogue agent, thanks to misconfigurations or compromises, can perform a wide range of actions using legitimate credentials without triggering traditional security alerts. 

In addition, workflows also cause a rapid expansion in the number of machine identities. These systems often rely on multiple microservices, data pipelines, external APIs, vector databases, model hosting platforms, and third-party tools. As organizations deploy AI assistants, copilots, and autonomous workflows, they create large numbers of new non-human identities and inevitably, a growing attack surface. 

So, what steps can be taken to tackle these issues? A primary step is shifting from human-centric to machine-centric identity governance. This can be achieved by building a unified inventory of all identities, both human and non-human. This will provide visibility into what identities exist, where they are located, and what permissions they hold. The next step is replacing static credentials with dynamic, short-lived ones. Instead of long-lived API keys or passwords, organizations should adopt just-in-time credentials, automated rotation, and ephemeral tokens. This approach reduces the window of opportunity for attackers and limits the impact of credential compromise. 

Sanket Kadam, Senior Security Analyst at QKS Group, explains, “The acceleration of Non-Human Identities has fundamentally outpaced traditional governance models, creating a structural control deficit across cloud and DevOps environments. Organizations are increasingly exposed not only because of a lack of security tools, but also due to fragmented visibility, credential sprawl, and inconsistent lifecycle controls for machine identities. Treating NHIs as a peripheral extension of human IAM is no longer viable; it requires a purpose-built, identity-first governance framework. Enterprises that institutionalize automated discovery, dynamic credentials, and least-privilege enforcement at scale will materially reduce operational and security risk.”

Applying least-privilege principles to machines is equally important. Non-human identities should have only the permissions they need to perform their tasks, and nothing more. Role-based access, policy-driven permissions, and automated reviews can help enforce this at scale. Automation is essential because the volume of non-human identities makes manual governance impractical. 

Lifecycle management must also become automated. Every non-human identity should have a clear owner, a defined purpose, and an expiration or rotation policy. When applications are retired or pipelines are decommissioned, their associated identities should be removed automatically. This prevents the accumulation of orphaned accounts and unused credentials. 

In the end, it doesn’t matter what the ratio of NHI and human IDs is in your environment. It is about whether your identity governance can evolve fast enough to keep up. If it doesn’t matter, to paraphrase Oscar Wilde, life with good governance is rarely dramatic; life under bad governance is always so. If you don’t want your life to be dramatic, here is a handy vendor landscape.  

The explosive growth of NHIs is driven by several technology shifts. The move to cloud-native architectures has led to monolithic applications segmented into microservices that constantly “talk” with one another. Each of these services requires its own identity to authenticate and authorize requests. At the same time, enterprises are adopting API-first strategies, exposing internal and external capabilities through programmable interfaces. Every integration partner, application, and automation tool requires its own credentials, which inevitably leads to a proliferation of API tokens and secrets. DevOps practices further amplify this trend, as pipelines, automation scripts, and infrastructure-as-code tools rely on service accounts to access repositories, cloud environments, and production systems. More recently, the emergence of AI-driven agents and autonomous workflows has introduced a new class of non-human identities. These are entities that not only execute tasks, but also make decisions and initiate actions independently, and as is the way, introduce new risks. 

Traditional service accounts followed scripts or fixed workflows. Their behavior was known, and their actions could be constrained by tightly defined permissions. Unlike this, AI agents interpret data dynamically, make real-time decisions, and initiate actions across multiple systems. For example, an AI-driven customer service agent may access CRM data, update customer records, trigger refunds, and interact with billing or logistics systems. Each of these actions requires access rights, and the agent’s behavior may vary depending on context, prompts, or incoming data. This makes it harder to predict or constrain what the identity might do. A rogue agent, thanks to misconfigurations or compromises, can perform a wide range of actions using legitimate credentials without triggering traditional security alerts. 

In addition, workflows also cause a rapid expansion in the number of machine identities. These systems often rely on multiple microservices, data pipelines, external APIs, vector databases, model hosting platforms, and third-party tools. As organizations deploy AI assistants, copilots, and autonomous workflows, they create large numbers of new non-human identities, and inevitably, a growing attack surface. 

So, what steps can be taken to tackle these issues? A primary step is shifting from human-centric identity management to machine-centric identity governance. This can be achieved by building a unified inventory of all identities, both human and non-human. This will provide visibility into what identities exist, where they are located, and what permissions they hold. The next step is replacing static credentials with dynamic, short-lived ones. Instead of long-lived API keys or passwords, organizations should adopt just-in-time credentials, automated rotation, and ephemeral tokens. This approach reduces the window of opportunity for attackers and limits the impact of credential compromise. 

Applying least-privilege principles to machines is equally important. Non-human identities should have only the permissions they need to perform their tasks, and nothing more. Role-based access, policy-driven permissions, and automated reviews can help enforce this at scale. Automation is essential, because the volume of non-human identities makes manual governance impractical. 

Lifecycle management must also become automated. Every non-human identity should have a clear owner, a defined purpose, and an expiration or rotation policy. When applications are retired or pipelines are decommissioned, their associated identities should be removed automatically. This prevents the accumulation of orphaned accounts and unused credentials. 

In the end, it doesn’t matter what the ratio of NHI and human IDs in your environment. It is about whether your identity governance can evolve fast enough to keep up. If it doesn’t matter, to paraphrase Oscar Wilde, life with good governance is rarely dramatic; life under bad governance is always so. If you don’t want your life to be dramatic, here is a handy vendor landscape.