Home›Blog›Non-Human Identity: Who Verified the Human Behind It?
Back to Blog

Non-Human Identity: Who Verified the Human Behind It?

·Mairi Kutberg ·
non-human-identitynhimachine-identitycybersecurityidentity-proofingapi-securitysupply-chain

18.1 million API keys exposed in 2025. Machine identities outnumber humans 100:1. NHI industry secures machines — but humans who created them are unverified.

Non-Human Identity: Who Verified the Human Behind It?

Machine identities outnumber humans 80:1 in 2026, and the $38 billion non-human identity market secures the machines but not the humans who created them. SpyCloud recaptured 18.1 million exposed API keys in 2025. Every NHI was created by a person; if that person was never verified, the machine identity governance has no anchor.

A single GitHub access token belonging to a Home Depot employee remained publicly accessible for over a year. It granted read and write access to hundreds of private repositories, cloud infrastructure, order-fulfilment systems, and developer pipelines. The token was a non-human identity — a machine credential that authenticated without challenge. It was only revoked after a security researcher went to the media, as BleepingComputer reported in early 2026.

That was not an anomaly. It was a preview of how breaches work now.

Trevor Hilligoss, Chief Intelligence Officer at SpyCloud, described the shift in the company's 2026 Identity Exposure Report: "We're witnessing a structural shift in how identity is exploited. Attackers are no longer just targeting credentials. They're stealing authenticated access — including API keys, session tokens and automation credentials — and using this access to move faster, stay persistent, and scale attacks across cloud and enterprise environments."

SpyCloud's numbers back the claim. They recaptured 18.1 million exposed API keys and tokens in 2025 alone. They identified 6.2 million credentials tied to AI tools. Their identity datalake grew 23% to 65.7 billion distinct records. Non-human identity theft is no longer an edge case — it is the centre of the attack surface.

The Scale Most Leaders Underestimate

The ratio of machine identities to humans in a modern enterprise is not 2:1 or 5:1. CyberArk's 2025 Identity Security Landscape pegs the global average at more than 80 to 1, rising to 96 machines per human in financial services. According to CSO Online's 2026 analysis, ManageEngine's Identity Security Outlook found some organisations reporting ratios of 100:1, with outliers reaching 500:1.

And "non-human identity" is far broader than most security teams realise. It is not just API keys and service accounts. It includes every entity that authenticates without a human at the keyboard: scheduled processes and cron jobs that run nightly data transfers, RPA bots that process invoices and update CRM records, IoT devices and sensors — GPS trackers, temperature monitors, telemetry units — that stream data into enterprise systems, Kubernetes pods and serverless functions that spin up, authenticate, act, and disappear in seconds, message queue consumers that process events across distributed architectures, database connection pools that authenticate thousands of queries per minute, backup and disaster recovery processes with broad access to production data, and CI/CD pipelines that deploy code to production with credentials baked into environment variables.

Every one of these creates machine credentials that authenticate continuously, often with broad permissions.

The NHI access management market was valued at $11.3 billion in 2025 and is projected to reach $38.8 billion by 2036. The growth is driven by exactly the problem CSO Online described: while we spent the last decade perfecting MFA rollouts and Zero Trust architectures for human users, machine identities were quietly multiplying across our environments, completely outside our governance programmes.

Entro Security's 2025 State of Non-Human Identities report found that 97% of non-human identities have excessive privileges. Just 0.01% of machine identities control 80% of cloud resources. And 71% of NHIs are not rotated within recommended timeframes. Every day a credential sits unchanged is another day an attacker could be using it without detection.

The security industry's consensus for 2026 is clear. As CSO Online summarised: Tenable predicts it, Delinea predicts it, One Identity predicts it — machine identities will become the primary breach vector in cloud environments. One Identity specifically predicted that 2026 will see the first major breach traced back to an over-privileged AI agent.

13 Attacks in 16 Months: The Pattern

The incidents are no longer hypothetical. Astrix Security documented 13 significant NHI-related attacks between mid-2024 and late 2025, revealing a consistent pattern.

The US Treasury network was breached through a compromised third-party service provider (BeyondTrust). Hundreds of Snowflake instances were compromised by a single threat actor exploiting stolen credentials, affecting approximately 165 organisations. The New York Times had its source code stolen through an over-privileged GitHub token. HuggingFace reported unauthorised access resulting in stolen tokens and API keys from its Spaces platform. Flare researchers found over 10,000 Docker Hub container images leaking production API keys, cloud tokens, and AI model access credentials.

The biggest SaaS breach of 2025, as Obsidian Security documented, started with a compromised third-party app. Attackers exploited OAuth tokens that granted access to hundreds of downstream environments. The blast radius was 10x greater than previous direct-access attacks.

The common thread across every one of these incidents: the attacker did not break in. They logged in — using a valid non-human identity that the system trusted.

The Industry's Response — And Its Blind Spot

The NHI security industry is responding with serious investment. CyberArk, Microsoft, Okta, HashiCorp, Astrix, Permiso, and dozens of others are building platforms to discover, manage, and secure machine identities. The capabilities are real: automated discovery, lifecycle management, privilege analysis, anomaly detection, just-in-time access, credential rotation.

This work is necessary, and the field now has a common taxonomy for it — the OWASP Non-Human Identities Top 10 (2025) catalogues the ten most critical NHI risks, from improper offboarding and secret leakage to over-privilege and long-lived secrets. Notably, NHI10:2025 is titled "Human Use of NHI" — even OWASP treats the human operator as part of the attack surface. But it has a structural blind spot.

Every non-human identity was created by a human. Every API key was generated by a developer. Every service account was provisioned by an administrator. Every OAuth application was authorised by a business user. Every AI agent was delegated authority by a person.

The NHI security stack manages what happens after the machine credential exists. It discovers it, classifies it, monitors it, rotates it, revokes it. What it does not do — what almost no NHI platform does — is verify who created it in the first place.

This matters because the most dangerous NHI scenarios are not about a forgotten API key. They are about a person who should not have had the authority to create that credential — or a person whose identity was compromised before they provisioned the machine identity.

As Palo Alto Networks' Unit 42 analysis showed, the typical cloud breach lifecycle hinges on exploiting misconfigured non-human identities. The attacker compromises a workload, steals credentials from environment variables, and impersonates the NHI to access other resources. But who configured that NHI's permissions? Who authorised its creation? Was that person verified — or were they using a shared admin account with no identity proofing?

The Developer With God-Mode Access

CSO Online captured the most common failure pattern with painful clarity. A developer needs a service account for a new Lambda function. They are under deadline pressure. Figuring out the exact minimum permissions takes time, so they attach AdministratorAccess and move on. The function works. Nobody revisits it.

That account now has god-mode access to the entire AWS environment for a task that needed read access to one S3 bucket. Multiply this across every team, every sprint, every year.

The NHI security platforms can detect this over-privilege. They can flag it. They can even automatically reduce it. But they cannot answer the question: should this person have been creating service accounts at all? Were they verified as who they claimed to be? Were they authorised to provision infrastructure credentials?

In a world where deepfakes can forge any visual identity, where phishing attacks have surged 400% year-over-year (SpyCloud), and where 1.1 million password manager master passwords are circulating in underground sources — the identity of the person creating NHIs is not something that can be assumed. AI agent and NHI identity verification anchors every machine-identity provisioning event to a passport-chip-proofed responsible human.

The Human Root of Trust

Trust chain showing how every non-human identity — API keys, service accounts, OAuth tokens, AI agent credentials — traces back to a human who created it, with statistics on exposure and the question of whether that human was verified

The argument is simple. You cannot secure 100 machine identities per human if you have not secured the one human identity they all trace back to. The chain is:

Human → creates/authorises → non-human identity → accesses → systems and data.

If the human at the start of that chain is compromised, every NHI they created or authorised is compromised. If the human was never verified to begin with — if they are a phantom employee, a social-engineered insider, or an attacker who compromised an admin account — then the NHI security stack is managing credentials that were illegitimate from the start.

This is why identity proofing at the human level is not separate from NHI security — it is foundational to it. The NHI platforms manage the machines. The human identity proof anchors the trust.

At IdentiGate, we provide that anchor. A person scans their biometric passport via NFC, completes liveness verification, and receives a cryptographically verified digital identity in 90 seconds. That identity becomes the root of trust for everything they create and authorise — service accounts, API keys, AI agent delegations, access policies.

When an incident response team asks "who created this service account?", the answer is not a username in an Active Directory log. It is a cryptographically verified human identity, anchored to a government-issued document, with a complete audit trail.

What Security Leaders Should Do

The NHI problem is real and the NHI platforms are necessary. But they are insufficient without the human identity layer. Here is the practical sequence.

Connect every NHI to a verified human owner. Not a team name. Not a shared admin account. A specific, proofed individual who is accountable for that credential's existence and permissions. Make this a requirement in your NHI governance policy.

Implement identity proofing for privileged provisioning. Before someone can create a service account, generate an API key, or authorise an OAuth application with broad permissions, verify their identity at a level that goes beyond their Active Directory login. For high-risk actions, this means cryptographic identity proofing — not just MFA. In OT environments, this is no longer optional: NERC CIP-003-9, NIS2 Article 21(2)(i), and IEC 62443-2-4 all require vendor remote sessions to bind to a verifiable named individual.

Audit the human layer of your NHI inventory. You probably know how many machine identities you have (or you should). Do you know how many humans created them? How many of those humans have been identity-proofed? How many used shared credentials to provision machine identities?

Apply Zero Trust principles to NHI creation, not just NHI usage. Most NHI governance focuses on how machine identities are used after creation. Apply the same "never trust, always verify" principle to the moment of creation — the human act that brings the NHI into existence.

The $38.8 billion NHI market is building the infrastructure to manage machine identities at scale. That is the right investment. But machines do not create themselves. Humans create them, authorise them, and delegate authority to them. If you cannot verify the human, you cannot trust the machine.

SpyCloud's 65.7 billion identity records circulating in the criminal underground include both human and machine credentials. The attackers do not distinguish between them. Neither should your security strategy.

Sources

IdentiGate provides the human identity proofing layer that NHI governance requires — cryptographic verification from biometric passports issued by more than 170 countries, linking every machine identity to a verified human owner. Learn more at identigate.com

About the author

Mairi Kutberg is co-founder of IdentiGate, where she runs operations and content. She works at the intersection of EU regulation (eIDAS, NIS2, AMLR, eFTI), cross-border digital identity, and the practical compliance angles of advanced electronic signatures.

All Articles