Imagine your company has 200 employees, but 10,000 digital identities. Sounds absurd? It's reality: non-human identities (NHI), service accounts, API keys, tokens, certificates and, increasingly, AI agents, now outnumber human identities in modern organizations by 25 to 50 times. And while every employee goes through onboarding, MFA and offboarding, machine identities are often created by copy-paste, and never die.
The consequence: 68% of all identity security incidents today involve machine identities. Half of all organizations have already suffered a breach through unmanaged NHIs, and 32% can't even say whether they were affected. This post covers what non-human identities are, why they become a compliance topic in 2026, and how a pragmatic 3-step plan puts you back in control.
TL;DR
- NHIs outnumber humans 25:1 to 50:1, and every AI agent you ship adds more.
- 68% of identity incidents involve machine identities; ~50% of companies have already been breached through unmanaged NHIs.
- Regulators start asking for NHI governance evidence in 2026 (NIS2, DORA, EU AI Act), fewer than 25% of companies have policies.
- The fix is systematic: Inventory → Lifecycle → Runtime Constraints.
What are non-human identities (NHI)? A definition
Non-human identities are all digital identities with no human behind them. They include:
- Service accounts, technical accounts for applications and batch jobs
- API keys and tokens, access credentials for system-to-system interfaces
- Certificates and secrets, machine authentication in CI/CD pipelines, cloud workloads and containers
- OAuth apps and integrations, third-party connections to SaaS platforms
- AI agents, the newest and fastest-growing category: autonomous software that accesses data and systems on its own
That last point is the game changer. Every AI agent that goes to production creates new identities, permissions and access paths, often without the security team knowing. The Cloud Security Alliance therefore calls NHIs the new, barely visible perimeter.
The 2026 numbers: NHI security in crisis
The current data is unambiguous, and alarming:
| Metric | Value |
|---|---|
| Ratio of NHIs to humans in the enterprise | 25:1 to 50:1 |
| Identity incidents involving machine identities | 68% |
| Organizations breached through unmanaged NHIs | ~50% |
| Organizations that don't know if they were affected | 32% |
| Organizations with documented policies for AI identities | < 25% |
Prominent incidents of recent years, from Snowflake to Cloudflare to Hugging Face, shared one trait: compromised or over-privileged machine identities as the entry point. The 2026 NHI Reality Report adds another dimension: attack speed is rising, because AI agents operating with stolen NHI credentials move at machine speed, data exfiltration no longer takes days, it takes minutes.
The four core problems of unmanaged machine identities
1. Zombie identities
Service accounts and API keys whose purpose nobody remembers, whose owner left the company, but which remain valid. Every zombie identity is an unguarded side entrance into your infrastructure.
2. Over-privileged agents
NHIs are typically granted broad permissions at setup ("that way it definitely works") that are never scoped back down. An AI agent with admin rights on your CRM is a total loss in a compromise scenario.
3. The confused-deputy problem
An attacker tricks a legitimate, highly privileged agent into acting on their behalf, for example via prompt injection. The agent itself becomes the attack weapon, and no credentials need to be stolen at all.
4. Missing kill switches
Humans can be locked out, sessions terminated. For many NHIs there is no defined way to shut them down immediately and completely in an emergency, no lifecycle boundaries, no runtime constraints, no emergency stop.
NHI governance becomes a compliance requirement in 2026
New this year: regulators and auditors are explicitly asking for NHI governance evidence for the first time, as part of cloud, resilience and AI assessments (see NIS2, DORA and the EU AI Act). What's typically required boils down to three things: a complete inventory of all machine identities, demonstrable lifecycle processes, and documented runtime restrictions.
The problem: fewer than a quarter of organizations even have formally approved policies for creating and deleting AI identities. If you're being audited in 2026, this is an acute gap.
The 3-step plan: Inventory → Lifecycle → Runtime Constraints
- Inventory, create visibility. You can't protect what you don't know. Catalog all NHIs across cloud environments, SaaS tools, CI/CD pipelines and on-prem systems. Every identity needs a human owner, a documented purpose and an expiry date. NHI discovery tooling has matured, GitGuardian maintains a current overview.
- Lifecycle, govern creation and death. Define a binding process: who may create NHIs? With what maximum permissions (least privilege)? When are credentials rotated? And above all: when and how are identities automatically deprovisioned? Zombie identities are born wherever offboarding for machines doesn't exist.
- Runtime constraints, limit and monitor behavior. Non-negotiable for AI agents: scope permissions to the minimum, use short-lived tokens, monitor behavior for anomalies, and implement a kill switch that can stop any agent instantly. An agent you can't switch off isn't a tool, it's a liability.
Conclusion: identity is the new perimeter, and it's machine-shaped
In 2026, non-human identities are no longer a footnote, they are the center of identity security. The numbers speak for themselves: 68% of incidents, 50% of organizations already hit, and every new AI agent grows the attack surface further. The good news: with inventory, lifecycle management and runtime constraints, the risk can be reduced systematically, before the auditor or the attacker asks first.
Next step: run an NHI inventory of your largest cloud environment this week. You'll be surprised what you find. Elmoz maps every non-human identity to what it can actually reach.