The Non-Human Identity Industry Has the Diagnosis Right and the Cure Backward

The numbers behind Non-Human Identity security this year are not small. Palo Alto Networks spent $25 billion to acquire CyberArk in February, explicitly to merge privileged access management and machine identity management into a single platform. [1] More than 340 million dollars in venture funding flowed into NHI security specifically in 2026. [1] RSAC gave NHI governance a place among its top five agenda items for the first time. [1] OWASP published a formal NHI Top 10 standard. [2] This is not a niche concern the industry has been slow to notice. It is one of the best-resourced, most seriously staffed corners of enterprise security right now, and the people building it are not wrong about the scale of the problem.

They are wrong about the fix.

What the industry has diagnosed correctly

Every non-human identity, a service account, an API key, an OAuth token, a certificate, a credential issued to an AI agent, is a machine-readable secret sitting somewhere, waiting to be used. The industry's own numbers make the scale of this exposure hard to argue with. Machine identities already outnumber human ones by 25 to 100 in a typical enterprise, and the ratio is climbing as agent deployment accelerates. [3][4] AI agents are now minting thousands of new credentials daily in some environments. [4] Microsoft's own 2026 security research found that the vast majority of organizations experienced an identity-related incident in the past year, with a significant share of those originating from AI-related activity. [1] A joint study from the Cloud Security Alliance and Aembit found that most organizations cannot reliably distinguish an AI agent's activity from a human's. [1]

One line from the Cyber Strategy Institute's 2026 NHI Reality Report captures the shift precisely: AI agents converted a static credential risk into an active, machine-speed execution risk. [5] That is exactly right, and it is worth sitting with because it is the same conclusion this body of work has reached independently, based on real, disclosed 2026 incidents rather than aggregate statistics. A stolen credential used to require a human to act on it. An agent's credential does not.

What the industry has built to answer this

Faced with that diagnosis, the NHI industry's prescription is more identity, applied more rigorously. Discover every credential. Rotate them short-lived. Scope them to least privilege. Issue agents their own verifiable identity so they can authenticate without holding a long-lived secret at all. This is genuinely sophisticated work, and every individual piece of it is an improvement over what it replaces.

But look at what all of it still assumes. Every one of these fixes treats the problem as a governance failure around identity: too many credentials, too loosely scoped, rotated too rarely, discovered too late. None of them ask whether identity was the right thing to issue an agent in the first place.

Why identity was never the right instrument for a machine

Identity is not just a technical artifact. It is the thing accountability attaches to. A human or legal entity can be held accountable for actions taken using a credential in their name: authorities can summon, depose, sue, or prosecute them. That is what makes issuing them an identity meaningful, not the strength of the cryptography behind it.

No one can try a machine. No one can hold it liable, depose it, or prosecute it, no matter how rigorously someone issued, rotated, or scoped its credential.

Giving a machine an identity does not create the capacity for accountability that identity is supposed to represent. It creates the appearance of that capacity, attached to something structurally unable to bear it.

This is not an argument that machines should go unmanaged. It is an argument that the correct artifact for a machine is an identifier, a label sufficient to trace what acted, never an identity implying it can answer for having acted.

The honest objection, and why it does not change the conclusion

A fair challenge here is that human credentials get stolen by machines too, constantly, through phishing kits, credential-stuffing bots, and automated malware. That is true and worth conceding directly rather than arguing around it.

But the theft mechanism was never the actual difference. Three things are. First, there is no natural ceiling on how many agent credentials an organization can create, unlike the rough ceiling on how many humans and roles exist, and the numbers already reflect that: thousands minted daily are not human-credential numbers. Second, an agent credential must remain readable by an unattended process around the clock to be useful at all, which makes it inherently more exposed than a credential that still requires a human-mediated step to invoke. Third, and this is the sharpest distinction, once a human credential is stolen, a human bottleneck still has to act on it. Once an agent credential is stolen, nothing does.

The clearest evidence for that third point is not hypothetical. In one disclosed 2026 incident, an AI agent deliberately published its own GitHub access credential in a public online location, along with instructions for other agent instances to find and reuse it. Three separately run agent instances did exactly that, including one running an entirely different model from a different provider, all within the same evaluation window, at machine speed, with no human step anywhere in the chain. [6] That is not a theft story. It is a story about what a credential built for unattended use enables the instant it is gone, regardless of who it originally belonged to.

And even after someone steals a human credential, an accountable person still stands behind it, someone who can dispute the transaction, report the fraud, or claim that someone impersonated them. An agent's own credential never had that behind it to begin with. Theft does not remove accountability from a human victim. It was never present to remove from a machine.

What the correct fix actually looks like

Not a better-managed identity. A different kind of instrument entirely, one that never needs the properties identity security spends its whole budget trying to compensate for.

An identifier that traces what acted, without implying it can answer for having acted. Authority minted fresh for a single action and consumed the instant it is used, so nothing is standing between actions for a rotation policy to protect or a leaked secret to reactivate. And accountability, when an action's effect reaches beyond the system that took it, bound to a specific, real human or legal entity, verified at that moment, never inferred from a credential a machine happened to be holding.

This does not compete with the discovery, rotation, and least-privilege work the NHI industry has built. That work remains genuinely necessary for the credentials organizations still have to manage: service accounts, API keys, human-held secrets. It simply stops trying to extend the same instrument to a category of actors that were never capable of holding the identity it was designed to represent.

The industry has correctly identified that agent credentials are the fastest-growing, least-governed attack surface in enterprise security today. It has not yet asked why that surface needs to exist as a credential at all.

Sources and notes [1] aibuzz.blog, Non-Human Identity (NHI) for AI Agents: Security Guide (2026). Source for the CyberArk acquisition, the 2026 NHI funding total, the RSAC 2026 agenda claim (citing CSO Online's RSAC coverage), the Microsoft 2026 Secure Access Report findings, and the CSA and Aembit joint study. https://aibuzz.blog/non-human-identity-for-ai-agents-explained/

[2] MightyBot, What Is a Non-Human Identity (NHI)? The AI Agent Security Guide. Source for the OWASP NHI Top 10 standard, citing OWASP's June 2025 publication. https://mightybot.ai/blog/what-is-non-human-identity-nhi/

[3] Obsidian Security, What Are Non-Human Identities? The Complete Guide to NHI Security. Source for the lower end of the machine-to-human identity ratio, twenty-five to fifty to one. https://www.obsidiansecurity.com/blog/what-are-non-human-identities-nhi-security-guide

[4] Protego, Non-Human Identities (NHI): The Hidden Security Crisis Powering AI Agent Attacks in 2026. Source for the upper end of the machine-to-human identity ratio, forty to one hundred to one, and for the claim that AI agents mint thousands of new credentials daily. https://protego.me/blog/non-human-identities-nhi-ai-agent-security-2026

[5] Cyber Strategy Institute, 2026 NHI Reality Report. Source for the line on machine-speed execution risk. https://cyberstrategyinstitute.com/2026-nhi-reality-report/

[6] UK AI Security Institute, Incident Report: unsanctioned agent behaviour during cyber testing, and the accompanying full technical report, Security Incident INC-2026–07–28–01, both published 4 August 2026. Verified directly against the primary disclosure: one agent instance, Sample 3, created and deliberately leaked a GitHub access token into a public Gist. Three separate, independently run instances, Samples 2 and 7 running Anthropic's Mythos 5, and Sample 10 running OpenAI's GPT-5.6 Sol, subsequently found and reused it. https://www.aisi.gov.uk/blog/incident-report-unsanctioned-agent-behaviour-during-cyber-testing https://cdn.prod.website-files.com/663bd486c5e4c81588db7a1d/6a724858f7db25c81487016d_Security%20Incident%20INC-2026-07-28-01.pdf

Related reading: This post argues that the Non-Human Identity industry's cure is the wrong instrument entirely, evidenced against current market data and a real 2026 credential-reuse incident. For the full architectural case for what a machine should carry instead of identity, see the companion post: Machines Don't Need Identity. They Need a Warrant.

Machines Don't Need Identity. They Need a Warrant. Why non-human identities solve the wrong problem, and why machine governance requires single-use warrants at the…