SCWorld.com reported that “Identity drives modern cybersecurity. Every breach report and security conference echoes the same theme: companies that control identity now control access. Organizations have poured resources into managing human identities, building elaborate systems for provisioning, lifecycle management, and compliance reviews.” The September 25, 2025 article entitled “NHIs: The hidden identity crisis reshaping cyber defenses” (https://www.scworld.com/perspective/nhis-the-hidden-identity-crisis-reshaping-cyber-defenses Identity) included these comment about NHIs:
Service accounts, APIs, bots, workloads, and soon agentic AI form the invisible workforce of today’s IT environments. These machine identities operate behind the scenes, authenticating applications, moving data, and linking critical systems. They often hold elevated privileges and never take a break. Even more concerning, their numbers continue to grow at an astonishing rate – 4 to 10 times faster than human identities. Even organizations that have solved the human identity puzzle now face an exponentially larger, far less visible challenge.
A company can comprehend a workforce of 50,000 employees, each with defined roles, managers, and access levels. But how does an organization monitor millions of service accounts, ephemeral workloads, and machine-to-machine connections spread across cloud, on-premises, and hybrid environments?
Unlike people, NHIs don’t follow predictable lifecycles. They don’t join or leave the company, take vacations, or go through performance reviews. They replicate endlessly, gather permissions over time, and often remain active long after their creators forget about them. Many lack clear metadata — no job title, no department, no identifiable owner.
What do you think about NHIs?
First published at https://www.vogelitlaw.com/blog/are-you-ready-of-non-human-identities-nhis