The cybersecurity industry has discovered a new crisis: Non-Human Identities (NHI). But is this genuinely the “next critical battlefront,” or are we watching vendors rebrand a decades-old problem to create a new market category?
As someone who’s spent years analyzing identity security markets, I’ve watched this pattern before. A legitimate security gap gets repackaged with urgent language, a 45:1 ratio appears in every vendor deck, and suddenly CISOs are being told they’re ignoring their biggest vulnerability. The NHI narrative ticks every box. The fact that it coincides with the emergence of AI tools is no coincidence.
But what makes this case interesting is that unlike some manufactured crises, there’s substantial evidence of real harm. NHI risks exist, yes, but do the vendor response match the actual threat?
The Case for Concern
Over 40 major security incidents in the past three years involved compromised machine credentials, API keys, or service accounts—at least according to the suspiciously comprehensive catalogs maintained by organizations like the “Non-Human Identity Management Group,” which appears to have materialized alongside the market opportunity.
BeyondTrust, Cisco, Okta, Cloudflare, Uber, CircleCI, the Internet Archive, Dropbox, GitHub, Microsoft, the New York Times. Attackers used the same method every time.
A Cloud Security Alliance survey of 818 IT professionals found that 20% of organizations have already experienced an NHI-related security incident. GitGuardian’s analysis revealed that 70% of secrets exposed in public repositories in 2022 remained active three years later. Gartner and Forrester have both dedicated research coverage to the problem.
The breaches are real, and the concern is legitimate.
The Vendor Amplification Machine
This is where it gets interesting.
The Non-Human Identity Management Group positions itself as “the market leading research and advisory firm in the Non-Human Identity space”, which is easy to claim when the space was invented last Tuesday. Their breach catalog is genuinely useful, but the methodology is revealing: any incident involving credentials of any kind gets filed under “NHI breach.”
Then there’s the parade of startups, each explaining why they’re uniquely positioned to solve this crisis, all launched within the past few years, all citing the same Gartner statistics.
The Ever-Escalating Ratio
“Machine identities outnumber human identities by 45:1.” But wait—ManageEngine’s latest report claims ratios now “commonly exceed 100:1” with “some sectors approaching 500:1.”
Fascinating how these numbers keep climbing. Next quarter, I’m expecting someone to claim 1000:1 ratios while ominously noting that “machines have achieved sentience and are now creating their own identities.”
I think these numbers are self-defeating. Once these identities scale it becomes almost pointless to talk about managing them. Think about it.
The problem is that the ratios are treated as self-evident proof of proportional risk. But this is lazy mathematics. A production database connection string doesn’t carry the same risk profile as your intern’s user account. That CI/CD service account with read-only access to a test environment isn’t equivalent to domain admin credentials. Context matters. Privilege matters. Exposure matters.
The Real Story
ManageEngine’s research reveals the actual problem beneath the hype: While 80% of leadership believes their organization tracks dormant or orphaned machine accounts, only half of practitioners confirm this is actually happening. This is the classic executive-reality disconnect—along with the leading questions that vendor-commissioned surveys are famous for.
Only 12% of organizations have achieved comprehensive automated lifecycle management for machine identities. The remaining 88% rely on manual or ad-hoc processes.
This is the real story. Organizations automated their infrastructure but forgot to automate the governance of that automation. They created thousands of service accounts, API keys, and OAuth tokens—and then managed them with spreadsheets and tribal knowledge.
What We’re Really Talking About
Strip away the new terminology and here’s what NHI actually means:
- API keys and tokens hardcoded in source code
- Service accounts created by DevOps with no lifecycle management
- OAuth credentials that never expire or rotate
- SSH keys and certificates with unclear ownership
- Database connection strings stored in plain text
- Cloud provider credentials leaked in repos
This is secrets management. It’s credential lifecycle governance. It’s privilege sprawl in automation pipelines. We’ve had names for these problems for twenty years. We’ve had solutions—secrets managers, vaults, PAM tools, scanning tools—for at least fifteen.
Organizations didn’t implement them properly. DevOps teams prioritized velocity over security. Developers hardcoded credentials because it was faster. Nobody owned the service account inventory. Secrets never rotated because everyone feared breaking production.
Now the industry has repackaged this accumulated technical debt as “Non-Human Identity” and created a new market category with dedicated vendors, analyst coverage, and OWASP Top 10 lists.
The Category Creation Playbook
I’ve watched this pattern before:
- Identify a real problem that’s been neglected
- Create new terminology that sounds more urgent than “better secrets management”
- Establish yourself as the category expert before the category even exists
- Commission research that validates the crisis (CSA survey? Commissioned by Astrix, an NHI vendor)
- Get analyst validation – Vendors and analysts play an elegant game of mutual validation. Nobody remembers who said “Non-Human Identity” first, but both groups understood immediately that it was money
- Launch standards and frameworks (OWASP Top 10 NHI Risks debuts 2025)
- Every vendor pivots messaging – Suddenly everyone has an “NHI solution”
I’m not saying this is malicious. This is how markets get created. But understanding the mechanism helps you evaluate whether you’re buying a solution to a real problem or buying into a narrative.
What Organizations Should Actually Do
Despite my skepticism about the hype cycle, the underlying problem demands attention:
- Inventory your non-human identities – You can’t manage what you don’t know exists
- Implement lifecycle management – They need onboarding, access review, and offboarding processes
- Rotate secrets regularly – 70% of exposed secrets from 2022 still active in 2025 is inexcusable
- Scan for exposed credentials – Public repos, config files, container images, CI/CD logs
- Apply least privilege – Scope credentials to actual requirements
- Separate environments – Dev credentials shouldn’t work in production
The Real Threat Hierarchy
When I talk to CISOs about identity security priorities:
Tier 1: Eliminate standing privilege for humans – If every user runs with admin rights all day, nothing else matters. Fix this first.
Tier 2: Implement MFA and eliminate passwords – Phishing-resistant authentication dramatically reduces compromise risk.
Tier 3: Govern service accounts and machine credentials – Now address the NHI problem.
Tier 4: Continuous evaluation and zero standing privilege – Dynamic access decisions based on real-time context.
Organizations that skip straight to NHI solutions while ignoring basic privilege management are optimizing the wrong thing. The fundamentals still matter most.
Conclusion
So is NHI a real threat or vendor gold rush? Both.
The breaches are real. The exposed credentials are real. The lack of lifecycle management for service accounts is a genuine security gap. Organizations that ignore this are taking unnecessary risks.
But the urgency is manufactured. The “45:1 ratio” doesn’t mean what vendors imply. The problem isn’t new—it’s accumulated technical debt from poor secrets management. And the solution often isn’t a dedicated “NHI platform”—it’s proper implementation of tools that have existed for years.
CISOs should absolutely address non-human identity risks. But they should do so with clear eyes about what they’re solving and why. Don’t buy the panic. Don’t accept vendor statistics at face value. Don’t assume new terminology means new solutions.
Just remember: before the rebranding, this was called “secrets management” and “service account governance.” The core problem hasn’t changed. Only the packaging.
And if someone tries to sell you an NHI solution before you’ve fixed standing privilege on your endpoints? Show them the door.
