The Non-Human Identity Crisis: When Machines Outnumber People 45 to 1

The Identity Layer Most Organizations Ignore

A service account authenticates to a production database. An API key grants a third-party integration read access to a cloud storage bucket. An AI agent requests credentials to call an external tool.

None of these identities belong to a human. All of them can be compromised.

Non-human identities (NHIs), digital credentials that authenticate machines, applications, and automated processes to systems and data without human intervention, have exploded in popularity in recent years. NHIs now outnumber human identities by ratios that range from 45:1 to more than 100:1.  Other reports put that ratio at anywhere from 17:1 on the conservative end to 144:1. And 78% of organizations lack documented, formally adopted policies for creating or removing them.

As one recurring theme at the Gartner IAM Summit 2026 put it: “Attackers do not break in anymore, they log in.”

Easy Targets: Common Points of Exploitation

Some of the most prevalent sources for these breaches include orphaned NHIs, over-privileged NHIs, and secrets (i.e., passwords, connection strings, encryption keys, and other credentials embedded directly in code or configuration files) that are leaked. 

Orphaned and Forgotten

A 2026 report from Veza found 824,000 orphaned identities in its dataset — a 40% annual increase. And 38% of dormant accounts retained live entitlements in core business applications.

Nearly 50% of NHIs exceed one year old. In AWS, 62% of machine identities showed no activity in 90 days yet retained full access.

Over-Privileged by Default

The privileges landscape is deteriorating. One Entro Security report found that 97% of NHIs carry excessive privileges beyond what their function requires. In AWS, 5.5% of machine identities hold full administrator access — so-called “Super NHIs.” 

The Secrets Sprawl Crisis

If NHIs are the identity layer organizations ignore, secrets are the credentials they can’t stop leaking.

GitGuardian’s State of Secrets Sprawl 2026 report documents the scale: 28.65 million hardcoded secrets were added to public GitHub commits in 2025. And outside repositories like Slack, Jira, Confluence, and other collaboration tools account for roughly 28% of these kinds of secret exposure incidents. Internal repositories are 6x more likely to contain hardcoded secrets than public ones, undermining the assumption that private repos are safe.

The remediation picture is worse than the exposure picture. That same GitGuardian report notes that 64% of valid secrets from 2022 remain active in 2026. Four years without revocation. And 71% of NHIs aren’t rotated within recommended timeframes.

Why Traditional IAM Fails for Non-Human Identities

Typically, organizations might lean on Identity and Access Management (IAM) platforms to help mitigate identity breaches. But IAMs were built for humans. They detect suspicious behavior based on human patterns — unusual login times, new geographic locations, impossible travel. NHIs operate continuously from multiple locations simultaneously. That’s normal behavior for a machine, and it renders human-centric anomaly detection useless.

Five structural gaps explain why:

Multi-factor authentication (MFA) doesn’t work for machines. NHIs don’t have the biometrics or ability to open up a secondary device like a phone that MFA requires. Machine identities rely entirely on the strength of their credential — and that credential is usually a static text string.

Scale overwhelms review processes. Each human worker already holds an average of 96,000 permissions spanning apps, data stores, and infrastructure. Quarterly access reviews designed for human headcounts can’t cover machine identity volumes.

No lifecycle triggers exist. Human identities have HR triggers — hire, transfer, terminate. NHI creation has no equivalent. Developers create service accounts during application development, cloud platforms auto-provision identity objects for every resource and container, and AI agents generate their own credentials. There’s no centralized deprovisioning process.

Static credentials persist indefinitely. Traditional IAM assumes periodic password rotation. NHIs use long-lived secrets that defy this assumption.

The OWASP Non-Human Identities Top 10

In 2025, the OWASP Foundation published the Non-Human Identities Top 10 — an authoritative risk framework dedicated to machine identity. It codifies what practitioners have struggled to articulate: NHIs face a distinct set of risks that human-focused security frameworks don’t address.

• Improper Offboarding — When projects end, employees leave, or services are deprecated, their associated NHIs remain active. With no HR-equivalent trigger for machine decommissioning, orphaned identities accumulate indefinitely.

• Secret Leakage — Hardcoded credentials are exposed in code repositories, logs, configuration files, and collaboration tools.

• Vulnerable Third-Party NHI — Third-party integrations introduce NHIs that the organization doesn’t control. In fact, 92% of organizations expose NHIs to third parties.

• Insecure Authentication — Machine-to-machine communications have weak authentication mechanisms, like static API keys and long-lived tokens with no mutual authentication.

• Overprivileged NHI — Service accounts created with admin credentials “temporarily” end up unnecessarily having these privileges permanently.

• Insecure Cloud Deployment Configurations — Misconfigured cloud resources expose NHI credentials through metadata services, environment variables, or insecure defaults.

• Long-Lived Secrets — Credentials persist for months or years without rotation.

• Environment Isolation — NHIs bridge development, staging, and production environments, allowing lateral movement across trust boundaries.

• NHI Reuse — Organizations use shared service accounts across multiple applications and environments, violating the principle of least privilege and complicating incident response.

• Human Use of NHI — Personnel use service accounts or machine credentials for interactive sessions, bypassing audit trails and MFA requirements.

Seven of these 10 risks — one, two, four, five, seven, eight, and nine — share a common root cause: the reliance on shared, static, long-lived secrets as the primary credential for machine identity. Replace the shared secret with a short-lived, cryptographically bound certificate, and the majority of these risks are structurally mitigated.

How Organizations Can Reduce their NHI Exposure Risk

The NHI security problem is real, but it’s not unsolvable. Organizations that take a systematic approach — inventory, remediate, automate, monitor — can reduce their exposure substantially.

1. Inventory Every Non-Human Identity

You can’t secure what you can’t see. Map all service accounts, API keys, OAuth tokens, certificates, bot accounts, and AI agent credentials across cloud environments, SaaS integrations, code repositories, and CI/CD pipelines. 

2. Assign Ownership

Every NHI needs an identified human owner responsible for its lifecycle. When that owner leaves the organization, their NHIs must be transferred or decommissioned; make this part of your HR offboarding and/or termination process.

3. Replace Shared Secrets With Certificates

API keys, static tokens, and hardcoded passwords are inherently shareable. Certificate-based authentication using X.509 certificates removes the shared secret entirely — the private key never leaves the machine; automated renewal eliminates the long-lived secret problem.

4. Enforce Least Privilege

Scope every NHI to the minimum permissions its function requires. Audit and revoke permissions for dormant identities.

5. Automate the Lifecycle

Manual credential management can’t keep pace with NHI growth rates of 44% year-over-year. Automated issuance, renewal, and expiration — particularly through protocols like SCEP and ACME — removes human bottlenecks and eliminates orphaned credentials.

6. Monitor for Anomalies

NHI abuse looks different from human credential abuse. Watch for unusual issuance volumes, unexpected credential attributes, authentication from new service contexts, and privilege escalation patterns.

How Certificate-Based Identity Eliminates Secret Sprawl

The non-human identity crisis is, at its foundation, a secrets management crisis. Every statistic in this report — 28.65 million leaked secrets, 64% unremediated after four years, 40% annual increase in orphaned identities, 97% excessive privileges — traces back to a single architectural choice: building machine identity on shared secrets that can be copied, pasted, committed to a repository, and forgotten.

Certificate-based authentication rewrites this equation. X.509 certificates use public-key cryptography where the private key is generated on the machine and never transmitted. There’s no secret to leak to GitHub, Slack, or Jira.

Automated lifecycle eliminates orphans. Protocols like ACME and Dynamic SCEP issue certificates programmatically at deployment, renew them automatically before expiration, and let them expire without manual cleanup. SecureW2 Dynamic PKI handles this issuance and lifecycle management as a fully managed cloud service, eliminating the infrastructure overhead of running an internal certificate authority.

Short-lived certificates close the remediation gap. When certificates are issued with validity periods measured in hours or days rather than months or years, the 64% of 2022 secrets that remain active becomes an impossibility. Even if a certificate were somehow intercepted, it expires before an attacker can weaponize it. 

Per-workload identity prevents reuse. Each container, pipeline, service, or AI agent receives its own unique certificate scoped to its specific function. SecureW2 ACME Device Attestation and Dynamic SCEP issue certificates with identity attributes that encode the workload’s specific role and permissions.

ML-powered anomaly detection catches what IAM misses. Because NHI behavior patterns differ from human behavior, detecting NHI abuse requires purpose-built monitoring. CertIQ ML Anomaly Detection monitors certificate issuance and authentication patterns across the entire machine identity lifecycle.

The architectural insight is straightforward: NHI-specific security vendors focus on discovering and governing the existing sprawl of secrets. Certificate-based identity eliminates the need for those secrets in the first place.