Sprawling Non-Human Identities Are the Next Big Cyber Risk

Uploaded on 2025-08-20 in TECHNOLOGY--Resilience, FREE TO VIEW

They say necessity is the mother of invention. As our reliance on digital infrastructure has grown, we’ve demanded more from our networks – seamless access, automated processes, uninterrupted user journeys, and effortless interoperability.

Each improvement has pushed us further toward a hyper-connected, “smarter” enterprise, but at a cost that rarely registers on the risk scale.

In the background, however, facilitating all of this, is a new type of workforce - an army of AI bots and agents that keep the wheels greased and automate our enterprise environments.

Identity has long since been the cornerstone of network security. We verify users with passwords, credentials, biometrics, and tools like multi-factor authentication to make sure that the only people our network are those that should be there.

Now, validating non-human identities (NHIs) is just as important – if not more so – than validating human ones.

These include the service accounts that run applications, the scripts that move data, the APIs that knit together systems, and the machine agents that act on instructions without human intervention. In most large organizations, NHIs already outnumber human users by as many as 50:1, yet they are treated as background infrastructure rather than active participants in the network. They don’t get offboarded when a developer leaves. They don’t receive login alerts or multi-factor authentication challenges. They often live and die entirely outside of the processes that govern human accounts.

The result is a blind spot that keeps expanding as automation and AI gain speed. NHIs are created in seconds by build pipelines, duplicated for convenience, or forgotten in legacy code. Once spun up, they often persist indefinitely, even when their original purpose has long expired. And unlike human users, their existence isn’t always documented, making it difficult to even quantify the scale of the problem. It’s one thing to see these non-human entities, but who’s governing them? Who or what is leveraging them? What access do they have? Are they still needed? In the rush to AI adoption, those questions will determine whether NHIs remain a silent force for efficiency, or become the next major vector for a wave of cyberattacks.

An Exponential Threat

NHIs multiply quickly, but they also multiply unpredictably. A single developer can create dozens of service accounts during a project sprint, each tied to a specific function or integration, and then leave them untouched for months or years. In continuous integration and deployment (CI/CD) pipelines, accounts may be automatically generated for every new environment, test, or container, with zero central oversight.

Some NHIs can even create others, as upstream systems or AI agents spawn new credentials to complete tasks.

Deleted accounts may be reintroduced when old code is redeployed, creating “ghost” identities that resurface without warning. This self-reinforcing cycle means that the NHI population in many organizations is compounding with every automation, every system update, and every AI-driven process adding to a hidden identity sprawl that no one fully owns.

In 2024, The New York Times had its source code stolen – not from a carefully orchestrated cyberattack or some advanced malware that was deployed on the network, but using a redundant, over-privileged access token. The token had a much longer expiry period that it needed, as was most likely left and forgotten on a compromised endpoint. No humans, other than the ones who found and abused the NHI, were involved.

Playing Catch-Up

Traditional identity governance was designed for a network environment where every account had a human behind it – a name, a role, and a predictable lifecycle. NHIs break that model entirely. They often have privileged access far beyond what most employees receive, yet lack the guardrails applied to human users: no HR-triggered offboarding, no regular access reviews, no adaptive authentication based on behavior.

While many Identity and Access Management (IAM) tools can discover these accounts, discovery alone doesn’t solve the accountability gap.

There’s no “chain of custody” or ownership of NHIs. True governance means being able to answer in real time what each NHI is doing, why it exists, and who is responsible for it. Without that, these “invisible” accounts become prime targets for attackers, who know that a compromised service credential can quietly open the door to critical systems without raising alarms.

NHIs are here to stay, and their population will inevitably grow. They will shape how systems talk, transact, and behave – but whether they’re a force for good or ill will depend entirely on how we govern them.

Nicolas Fort is Director of Product Management at One Identity

Image: Ideogram

You Might Also Read:

Understanding Identity & Access Management:

If you like this website and use the comprehensive 8,000-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.