For every human employee who logged into your systems this morning, roughly 82 non-human identities did the same behind the scenes — service accounts, API keys, OAuth tokens, CI/CD pipelines, and now AI agents, all authenticating without a person at the keyboard. That figure comes from a 2025 Identity Security Landscape report conducted by Vanson Bourne survey of 2,600 security decision-makers across 20 countries. It's not a hypothetical trend piece — it's the ratio inside your environment right now.
Most identity programs in the market right now were built for the other side of that ratio.
Here's why non-human identity (NHI) security has become its own discipline, what's changed the math in the last 18 months, and what actually closes the gap.
What Counts as an NHI Has Quietly Expanded
NHI used to mean service accounts and the odd hardcoded API key. Today it spans OAuth tokens, SSH keys, digital certificates, IAM roles, Kubernetes service accounts, RPA bots, SaaS-to-SaaS integrations, and — the fastest-growing category — AI agents that call APIs, chain tools together, and act on decisions without a human approving each step.
That last category isn't just "one more NHI type." A service account does the same narrow thing every time it runs. An AI agent reasons about which action to take next, so its blast radius depends on what it's allowed to touch — not just whether its credential leaked. Governing it takes runtime policy enforcement, not an inventory entry.
The Landscape Is Evolving Faster Than Most Programs Can Track
Two numbers from GitGuardian's State of Secrets Sprawl 2026 report frame the pace: 28.65 million new hardcoded secrets landed on public GitHub in 2025 alone, up 34% year over year — and secrets tied specifically to AI services jumped 81% in the same period. AI adoption isn't just adding NHIs; it's adding them faster than credential hygiene is catching up.
This isn't theoretical anymore. In April 2026, a breach at Vercel traced back to an OAuth-connected third-party AI tool with standing access to production environment variables — reported independently by Trend Micro, Push Security, and the Cloud Security Alliance. In this security incident, attackers gained unauthorized access to internal systems and a limited subset of customer credentials. And if that wasn’t enough, in November 2025, the Shai-Hulud (2.0) worm was involved in a supply chain attack by spreading across the npm ecosystem largely by harvesting exposed developer and CI/CD tokens to propagate further — documented by Wiz and Unit 42. Neither incident started with a stolen password. Both started with an NHI nobody was watching.
Why Traditional IAM Wasn't Built for This
Most IAMs assume a human lifecycle: someone gets hired, requests access, gets reviewed quarterly, gets offboarded when they leave. NHIs don't follow that pattern. There's no HR trigger when a service account outlives the project it was built for, no MFA prompt to flag anomalous use of a long-lived API key, and ownership of tools and tasks is often tribal knowledge that exists inside a specific team or a department— the engineer who created a credential has since moved teams, or left.
The 2025 Identity Security Landscape report referenced in the beginning puts numbers on the consequence: 42% of machine identities carry privileged or sensitive access, 87% of respondents' organizations had at least two identity-centric breaches in the past 12 months, and 68% say they lack identity security controls for AI specifically. The State of Secrets Sprawl 2026 report (also referenced earlier) adds a durability problem: 64% of secrets leaked in 2022 were still valid and exploitable as of January 2026. Static credentials don't expire on their own — and at NHI scale, nobody reliably rotates them.
What a Real NHI Program Actually Requires
Closing this gap isn't a vaulting problem alone — vaults solve storage, not sprawl. A working NHI program needs four things operating together:
- Discovery and ownership, not just inventory. Know every service account, key, and agent across cloud, on-prem, and SaaS, and who's accountable for each one. An identity with no owner is one nobody notices going stale.
- Ephemeral access over standing credentials. Just-in-time, time-bound access — issued when a workload needs it, revoked automatically after — shrinks the window an attacker can exploit even if a credential leaks.
- Lifecycle automation, including decommissioning. Provisioning gets attention; deprovisioning rarely does. Automated detection of orphaned and idle identities is what stops the two-year-old forgotten API key from becoming next year's incident.
- Runtime governance for AI agents. Inventory and access reviews aren't enough once an identity can decide what to do next. Agents need policy enforcement that scopes what they're allowed to touch and can intervene mid-action, not just log what already happened.
That's the model behind how we've built Securden's non-human identity and AI agent governance capabilities: ownership mapping and relationship graphing for discovery, just-in-time access to replace standing credentials, automated lifecycle and orphan-identity cleanup, and runtime policy enforcement for agents — running on one identity control plane instead of four disconnected tools.
The Key Takeaway
The human-to-machine ratio isn't reversing, and AI agents have turned NHI from a hygiene problem into a governance problem with real-time stakes. The organizations that get ahead of it aren't the ones buying another vault — they're the ones that can answer, for every non-human identity in their environment, who owns it, what it can access, and whether that access still needs to exist.
If you want to see what that looks like against your own environment, explore Securden's NHI and AI agent governance platform for free — no sales call required to look around.
