The Rise of Non-Human Identities: Why Bots, APIs, and AI Agents Need Governance

Every modern enterprise now operates two workforces. The first is the employees, contractors, and partners visible in the HR system. The second is the silent majority: service accounts, OAuth applications, API keys, certificates, IAM roles, SSH keys, workload identities, automation bots, and, increasingly, autonomous AI agents. Research from Entro Labs published in July 2025 found that non-human identities (NHIs) outnumber human identities at a ratio of 144 to 1, up from 92 to 1 only a year earlier, and growing roughly 44 percent year over year. CyberArk's 2025 State of Machine Identity Security Report puts the average at 82 machine identities per employee, while Veza's 2025 global study reports that ratio climbing to 40,000 to 1 in cloud-native environments. The math is now decisive: the population of credentials inside an enterprise is overwhelmingly machine, and the governance apparatus around them has not kept pace.

This is no longer a DevOps housekeeping problem. The Identity Defined Security Alliance (IDSA) found that 97 percent of organizations experienced an identity-related incident in the prior year. GitGuardian's State of Secrets Sprawl 2026 recorded 28.65 million hardcoded secrets pushed to public GitHub in 2025 alone, a 34 percent jump year over year, with AI service credentials growing 81 percent to 1.27 million incidents. Behind every recent landmark breach (Microsoft Midnight Blizzard in January 2024, Okta's support system compromise in November 2023, Internet Archive's Zendesk incident in October 2024, and the Salesloft Drift OAuth campaign of August 2025) sat a non-human identity that nobody owned, nobody had rotated, and nobody was monitoring.

Defining the non-human identity perimeter

A non-human identity is any digital credential that authenticates a software entity rather than a person. The category is broader than most security programs treat it. OWASP's working definition, codified in its 2025 Non-Human Identities Top 10 project, covers applications, workloads, APIs, bots, and automated systems that authenticate using passwords, certificates, tokens, keys, or attestation-based mechanisms. In practice, the inventory looks like this:

The defining property is not what the identity does but what it is not. NHIs are not tied to a person, not subject to interactive login, not protected by MFA in any normal sense, and rarely subject to the access reviews that govern human accounts. As OWASP's introduction to the NHI Top 10 puts it, "common human user security measures do not apply to them."

Measuring the scale of the problem

The numbers from primary research published in 2025 and early 2026 establish the dimensions of the governance gap. Each figure below comes from a named source rather than vendor marketing.

Two distinct trend lines emerge from this data. The first is volume: NHIs are multiplying faster than any program built around quarterly access reviews can absorb. The second is governance quality: the percentage of identities classified as overprivileged, stale, or completely unowned is growing, not shrinking, even as awareness rises. The market response is sized accordingly. Meticulous Research valued the global NHI access management market at USD 11.3 billion in 2025, projecting USD 38.8 billion by 2036 at a 12.2 percent CAGR.

Where traditional IAM breaks down

Identity and Access Management as a discipline was engineered around human assumptions. Users log in interactively, type passwords, receive MFA prompts on phones, get hired through HR, get fired through HR, and submit access requests through ticketing systems. Every control in the standard IAM playbook (MFA enrollment, periodic password rotation, joiner-mover-leaver workflows, quarterly access certification, conditional access policies based on device posture) presumes a human at the keyboard. None of those assumptions hold for non-human identities.

The mismatch produces five structural failures that recur across breach post-mortems:

1. No joiner-mover-leaver process. A service account created for a 2019 proof-of-concept rarely gets deprovisioned when the project ends. OWASP's NHI1:2025 risk, improper offboarding, exists precisely because NHIs accumulate as digital sediment without an HR-style trigger to remove them.
2. Static credentials with indefinite lifespan. CyberArk's 2025 finding that nearly half of NHI credentials are over a year old reflects the reality that secret rotation is operationally painful and frequently skipped. OWASP's NHI7:2025, long-lived secrets, codifies this as a top-tier risk.
3. No clear ownership. When a service account belongs to a team that has reorganized three times, accountability evaporates. Astrix Security's research consistently finds that the largest categories of NHIs in any enterprise are "shadow" or "orphaned" identities with no traceable creator.
4. Overprivileged by default. Engineers grant broad permissions to make integrations work, then never narrow them. OWASP NHI5:2025, overprivileged NHI, captures the pattern of administrative-tier permissions granted to credentials that need only read access.
5. No behavioral baseline. Human accounts have working hours, geographies, and typical actions. Machine identities operate at any hour from any region with any frequency, which makes anomaly detection materially harder unless behavioral analytics are purpose-built for machine traffic.

The aggregate effect is what Veza describes as access drift: permissions accumulate, credentials age, and the actual blast radius of any single compromised identity expands quietly over time until a breach reveals what nobody mapped.

Anatomy of the Salesloft Drift breach

No incident illustrates the NHI governance gap more cleanly than the Salesloft Drift compromise of August 2025. The mechanics are worth examining in detail because every failure point reflects a control that should have existed but did not.

Between March and June 2025, according to Mandiant's investigation summarized by UpGuard, the threat cluster tracked as UNC6395 (also called GRUB1) gained access to Salesloft's GitHub account. The attackers downloaded code repositories, added a guest user, and established persistent workflows. From the code, they moved into Drift's AWS environment, where they exfiltrated OAuth access and refresh tokens issued by Drift's customers to their connected SaaS platforms. Between August 8 and August 18, 2025, the attackers used those stolen tokens to authenticate as the Drift application against more than 700 customer Salesforce instances, executing automated SOQL queries with custom user-agent strings designed to blend in with legitimate API traffic.

The scope expanded rapidly. Google's Threat Intelligence Group confirmed that beyond Salesforce, the tokens granted access to Google Workspace accounts integrated with Drift Email. WTW's analysis documented further reach into Slack, Amazon S3, Microsoft Azure, and OpenAI integrations. Confirmed impacted organizations included Cloudflare, Google, PagerDuty, Palo Alto Networks, Proofpoint, SpyCloud, Tanium, Zscaler, Workday, Fastly, Dynatrace, Elastic, Toast, and Sigma Computing. The threat actor's primary intent, per Cloudflare's post-incident statement, was credential harvesting at scale: stolen records were searched for plaintext AWS keys, VPN credentials, Snowflake tokens, and passwords that had been pasted into Salesforce support cases.

"This pattern suggests UNC6395 is likely to continue pursuing supply-chain vectors, underscoring the need for stronger controls around third-party integrations." (Anomali, December 2025 retrospective)

The technical lessons map directly to OWASP NHI Top 10 categories. The OAuth tokens were long-lived (NHI7:2025) and overprivileged (NHI5:2025), allowing one credential to access multiple downstream systems. The third-party integration itself was the entry point (NHI3:2025, vulnerable third-party NHI). Monitoring of the OAuth application's behavior was insufficient to flag bulk SOQL exports as anomalous. Token rotation hygiene had lapsed across hundreds of customer organizations because no internal team owned the Drift integration end-to-end. Salesforce ultimately removed Drift from its AppExchange and Salesloft took the Drift application offline pending remediation.

The breach also marked an inflection in how the industry talks about supply chain risk. Obsidian Security researchers estimated the blast radius of the Drift compromise at roughly ten times that of prior SaaS supply chain attacks, because the OAuth tokens granted persistent, broadly scoped access to customer environments rather than requiring direct platform compromise. The single weak link, a chatbot integration with broad token scopes, became a transitive breach across hundreds of enterprises.

How AI agents reshape the identity equation

Treating AI agents as a new flavor of service account understates the problem. A traditional service account performs fixed operations with static permissions. An AI agent reasons about what action to take, selects tools dynamically, may invoke other agents, and operates across context boundaries that no static role definition anticipated. Strata Identity's 2026 research frames the difference plainly: agentic identities are dynamic, ephemeral, and self-directed, and the legacy NHI model cannot represent them adequately.

The scale forecast is severe. IDC projects up to 1.3 billion AI agents in operation by 2028. Gartner predicts that 40 percent of enterprise applications will embed task-specific AI agents by the end of 2026, up from less than 5 percent in 2025, and that 30 percent of enterprises will deploy AI agents operating with minimal human oversight. Every one of those agents needs an identity, a credential, a scope, and an audit trail. Most existing IAM stacks were not designed to issue or revoke any of those at machine speed.

The Model Context Protocol (MCP), now the de facto standard for connecting agents to tools, has expanded the attack surface accordingly. A live RSA Conference 2026 session demonstrated a complete Azure tenant takeover via an MCP vulnerability combined with remote code execution, confirming that MCP servers must be governed with the same rigor as API gateways. Microsoft published its Agent Governance Toolkit under MIT license in April 2026 specifically to address the ten OWASP Agentic Application risks (goal hijacking, tool misuse, identity abuse, memory poisoning, cascading failures, and rogue agents among them) with deterministic, sub-millisecond runtime policy enforcement.

The governance challenge is not theoretical. Strata Identity's 2026 survey reported that only 18 percent of security leaders express high confidence that their IAM systems can effectively handle agent identities. Just 23 percent of organizations have a formal, enterprise-wide strategy for agent identity. Fewer than half believe they could pass a compliance review focused on agent behavior. Teams are routinely sharing human credentials and access tokens with agents because no alternative governance model exists in production.

OWASP NHI Top 10: the 2025 risk taxonomy

OWASP released the Non-Human Identities Top 10 in 2025 as the first standardized framework for ranking NHI risk. The list was constructed using OWASP's Risk Rating Methodology against four dimensions: exploitability, prevalence, detectability, and impact. Data inputs included documented breaches from the prior three years, the National Vulnerability Database (CVE scores), and survey data including Datadog's State of Cloud Security reports from 2022, 2023, and 2024.

The taxonomy is not academic. Orca Security's research validated the rankings against billions of cloud scans, and Cloud Security Alliance has adopted the framework as a reference standard. For any organization building an NHI program, the Top 10 functions as the closest equivalent to the human-identity controls codified in NIST SP 800-63 or ISO 27001 Annex A.9.

Constructing a governance framework

An NHI governance program needs the same architectural completeness applied to human identity decades ago: discover, own, scope, rotate, monitor, and retire. The difference is that every control must run at machine speed and machine scale, with policy decisions evaluated continuously rather than at quarterly review points.

Discovery and inventory

The first deliverable of any NHI program is a unified inventory across cloud IAM, SaaS app registries, secret managers, code repositories, CI/CD pipelines, on-premises directories, and increasingly AI agent platforms and MCP servers. Astrix Security's research consistently finds that the largest source of risk in initial discovery sweeps is "shadow" NHIs that no current employee created or remembers. Inventory must include the identity itself, its credentials, its permissions, its actual usage pattern, and most critically a human owner.

Ownership and accountability

Every NHI needs a named human owner with revocation authority. The NHI Management Group's 2025 industry research found that 85 percent of organizations lack full visibility into third-party vendors connected via OAuth apps, 38 percent have no or low visibility, and 47 percent have only partial visibility. Without an ownership graph, no other governance control can function: rotation has no decision-maker, decommissioning has no trigger, and incident response has no contact.

Least privilege and scope

Permissions assigned to NHIs should be the smallest set that lets the workload function, refreshed against actual usage. AWS Access Analyzer, Azure Privileged Identity Management, and Google Cloud Recommender all surface unused permissions; the discipline is consuming those signals and acting on them. For AI agents specifically, BigID's 2026 governance framework recommends mapping each agent role to the minimum data classification it requires and enforcing those boundaries at the data layer, not the application layer.

Credential lifecycle

Long-lived secrets are the operational debt of the NHI category. The remediation pattern is to replace static credentials with short-lived ones wherever the platform supports it: AWS IAM Roles via STS, Azure Managed Identities, Google Cloud Workload Identity Federation, and the cloud-agnostic SPIFFE SVIDs. OWASP's introduction to the NHI Top 10 explicitly calls out short-term, attestation-derived credentials as the preferred direction. Where static secrets remain unavoidable, automated rotation through a vault is the minimum bar.

Monitoring and detection

NHI behavior must be baselined and anomalies escalated. The OAuth queries used in the Salesloft Drift attack were detectable: bulk SOQL exports with unusual user-agent strings, executed outside the integration's normal pattern. The detections existed in principle but not in production for most victims. Modern NHI platforms route activity through SIEM and SOAR systems with behavioral analytics tuned to machine traffic, and the most mature deployments (Identity Threat Detection and Response, or ITDR) treat NHI compromise indicators as first-class alert categories.

Agent runtime authorization

For AI agents specifically, runtime authorization is the layer that traditional IAM does not provide. Microsoft Entra Agent Identity, launched in April 2026, introduced a Policy Enforcement Point (PEP) and Policy Decision Point (PDP) architecture that evaluates each agent action against business and regulatory context at the moment of invocation. The Yubico-Delinea hardware-attested human-in-the-loop integration announced at RSAC 2026 represents another emerging pattern: high-risk agent actions trigger step-up authentication tied to a verifiable human decision, producing a traceable chain of control from agent action back to authorized human intent.

Mapping the vendor landscape

The NHI security market has matured through three distinct approaches, which the Cremit RSAC 2026 retrospective notes are now converging into unified NHI lifecycle management platforms. Each approach addresses a different layer of the problem.

The Futurum Group's December 2025 Cybersecurity Decision Maker survey identified "strict role-based and policy-based AI access controls" as the most-cited primary measure for securing agentic AI, which explains the consolidation pressure: Cisco's pursuit of Astrix, Palo Alto Networks' CyberArk acquisition, and the active acquisition posture of CrowdStrike and Check Point all reflect a thesis that NHI and agentic identity governance will sit inside platform security suites rather than persist as a standalone category.

Standards shaping workload and agent identity

Three standards bodies are defining the substrate that future NHI and agent governance will rely on.

SPIFFE (Secure Production Identity Framework For Everyone) and its reference implementation SPIRE provide a platform-agnostic standard for cryptographically attesting workload identity. A SPIFFE ID (for example, spiffe://acme.com/billing/payments) is bound to a workload through node and process attestation rather than a stored secret. The SPIFFE Verifiable Identity Document (SVID), issued as either an X.509 certificate or a JWT, carries the identity and is verified locally by receiving services. Uber and Google have publicly described production deployments using SPIFFE-based identity and Envoy-mediated mTLS, with short-lived credentials (hours to a day) that make revocation operationally tractable. SPIFFE eliminates the chicken-and-egg credential distribution problem by deriving identity from what a workload is and where it runs, not from what secret it holds.

OAuth 2.1 consolidates a decade of OAuth 2.0 best practices into a single specification, with mandatory PKCE, exact redirect URI matching, and the deprecation of bearer-token-in-URL flows. For non-human integrations, OAuth 2.1 is the foundation for delegation, scoped access, and token security. Strata Identity's 2026 analysis identifies OAuth 2.1 with extensions for agent delegation as the best near-term foundation for agentic identity, because it already supports the cross-domain trust patterns AI agents need.

The Model Context Protocol (MCP), originated by Anthropic and adopted broadly across the agent ecosystem through 2025 and 2026, defines how agents discover and call tools. MCP security has become a first-class concern; the RSAC 2026 Azure tenant takeover demonstration showed that an MCP server with insufficient authentication checks is a credential boundary, not a convenience layer. Microsoft's Authorization Fabric for AI Agents, published in April 2026, treats MCP requests as the natural enforcement point for runtime authorization, evaluating each call against policy before it reaches a target resource.

Regulatory pressures coming into force

NHI governance is moving from security best practice to compliance requirement. The regulatory calendar through 2026 makes this concrete.

The compliance posture being built into these frameworks is observability-first. Authorities are not yet prescribing specific controls; they are requiring that organizations can produce verifiable evidence of which agent or NHI took which action against which resource under which authorization. Strata Identity's 2026 research notes that fewer than half of surveyed organizations believe they could currently pass a compliance review focused on agent behavior. That gap closes only with telemetry built into the identity layer itself.

A practical sequence for implementation

NHI program maturity progresses through identifiable stages. The progression typically takes six to twelve months between levels with dedicated resources and executive support, according to research published by Permiso Security in 2025.

The practical sequence for moving up the maturity curve follows a pattern that has held across documented programs:

1. Inventory all NHIs across cloud, SaaS, on-premises, secret managers, and code. Assign a human owner to each. The Entro Labs guidance is unambiguous on starting with AWS: locate and delete unused IAM roles, then quarantine remaining administrative NHIs in a locked-down account with hardware-key MFA enforcement on AssumeRole calls.
2. Reduce overprivileged identities first. Excessive permissions create the largest blast radius per credential. AWS IAM Access Analyzer, Azure PIM, and equivalent tools provide the data; the work is reviewing and acting on it.
3. Eliminate long-lived secrets where the platform supports short-lived alternatives. Replace static AWS access keys with IAM Role assumption, Azure secrets with Managed Identities, and bespoke service certificates with SPIFFE SVIDs or OIDC-federated workload identity.
4. Establish behavioral monitoring of NHI activity. Route OAuth app activity, service account usage, and API key consumption into the SIEM with detection rules tuned for machine traffic patterns.
5. Build the agent-readiness layer before deploying agents at scale. Define identity provisioning, scope assignment, runtime authorization, and decommissioning before the agent count grows beyond what any team can review by hand.
6. Codify ownership and offboarding in the same systems that govern human joiners and leavers. The trigger for retiring an NHI should be as automatic as the trigger for disabling a departing employee's account.

The strategic outlook

Three forces will shape the next 24 months. The first is volume: if Entro Labs' 44 percent year-over-year NHI growth holds and Gartner's projection of 40 percent of enterprise applications embedding AI agents by end of 2026 is accurate, the identity population inside the average enterprise will roughly double again before mid-2027. No spreadsheet-driven inventory will survive that growth curve.

The second is consolidation. Cisco's intended USD 400 million acquisition of Astrix, Palo Alto Networks' acquisition of CyberArk, and the active acquisition posture across CrowdStrike, Check Point, and the major identity incumbents (Okta, SailPoint, Saviynt, Ping Identity) signal that NHI governance is being absorbed into platform security suites. For buyers, this changes evaluation criteria from feature checklists to telemetry depth, control coverage, and lifecycle integration. For practitioners, it accelerates the moment when NHI controls become a default expectation rather than a specialized purchase.

The third is regulatory alignment. The EU AI Act's high-risk obligations taking effect in August 2026, the Colorado AI Act in June 2026, and the NIST AI Agent Standards Initiative all converge on the same requirement: organizations must be able to produce auditable records of which non-human or autonomous actor took which action, on whose authority, against which resource. That capability is built at the identity layer or not at all.

The Salesloft Drift breach was not an outlier. It was a preview. The mechanics that compromised 700 organizations in August 2025 (an unmanaged third-party OAuth integration with long-lived, overprivileged tokens and no behavioral monitoring) describe the default state of NHIs across the global enterprise base. The organizations that close the gap before the next breach in this pattern will be the ones that treated NHI governance as an architectural commitment rather than a vendor purchase. As CyberArk's data shows, the trend lines for ungoverned permissions and stale credentials are still moving in the wrong direction. The decision in front of every security and identity team in 2026 is whether to reverse that trajectory deliberately, or to inherit the consequences of leaving it unmanaged for another year.