Ask a cloud security team how many employees can access production and they will have an answer. Ask how many service accounts, access keys, workload identities, API tokens, CI/CD credentials and AI agents can do the same, and the answer is usually a guess. Non-human identities (NHIs) are the connective tissue of modern cloud systems: every microservice, pipeline, integration and automation authenticates as something. They are also among the least governed assets in the enterprise, and attackers know it. In 2026, the rise of AI agents that act with delegated authority has turned this long-standing weakness into an urgent priority. This guide explains why NHIs are so risky, what the emerging standards say and how to build a practical program to secure them.
Why Non-Human Identities Became the Weak Link
Human identities have benefited from two decades of investment: single sign-on, multifactor authentication, joiner-mover-leaver processes and access reviews. Non-human identities grew up differently. They are created by developers and automation, often outside identity teams’ view; they authenticate with static secrets rather than MFA; they rarely have a clear owner; and they are seldom deprovisioned when the system that used them is retired.
Cloud adoption multiplied them. Each cloud account has roles and service principals; each Kubernetes cluster has service accounts; each SaaS integration has OAuth grants; each pipeline holds deployment credentials. AI agents add another layer: identities that are not just used by code a developer wrote, but by models deciding at runtime which tools to call.
Survey data reflects the gap. A Keeper Security survey of 109 cybersecurity experts, reported by Hackread in April 2026, found that only 28% of organizations could see every non-human identity across their cloud, office and SaaS environments, that more than 40% had experienced a security incident involving machine credentials or NHIs in the past year, and that 46% give AI-powered tools access to their most sensitive data and systems. It is a small, vendor-commissioned sample, but the direction matches what practitioners see daily.
What the Standards Say: Two OWASP Lists to Know
OWASP Non-Human Identities Top 10 (2025)
Published in 2025 and promoted by the Cloud Security Alliance, the OWASP NHI Top 10 gives teams a common vocabulary for machine identity risks:
- Improper offboarding
- Secret leakage
- Vulnerable third-party NHI
- Insecure authentication
- Overprivileged NHI
- Insecure cloud deployment configurations
- Long-lived secrets
- Environment isolation
- NHI reuse
- Human use of NHI
Several of these are quietly endemic in cloud estates: credentials that outlive the application that used them, keys committed to repositories, one service account shared by many workloads, production identities reused in test environments and engineers logging in as service accounts to bypass controls.
OWASP Top 10 for Agentic Applications (2026)
Released in December 2025, this list addresses risks specific to AI agents. Identity and privilege abuse appears explicitly, but several others are closely related to how agents are authorized: tool misuse and exploitation, agentic supply chain vulnerabilities, insecure inter-agent communication and rogue agents. Together, the two lists make clear that agent security is, to a large extent, identity security.
The Core Principles of NHI Security
- Know every identity: a continuously updated inventory across clouds, Kubernetes, SaaS, CI/CD and AI platforms, with an accountable owner for each.
- Prefer secretless authentication: use managed identities, IAM roles and workload identity federation (OpenID Connect between your CI system or cluster and your cloud) instead of stored keys.
- Make credentials short-lived: where secrets are unavoidable, issue them dynamically with short lifetimes and rotate automatically.
- One identity per workload: no sharing between services or environments, so actions are attributable and blast radius is limited.
- Least privilege, verified by usage: grant only what is needed and use entitlement analysis to remove permissions that are never exercised.
- Lifecycle by default: identities are created and destroyed with the workload, through infrastructure as code, not by hand.
- Monitor behavior: baseline what each identity normally does and alert on deviations, such as new regions, new APIs or unusual data volumes.
Extending the Principles to AI Agents
AI agents are a special class of non-human identity because their behavior is not fully predetermined. A traditional service calls the same APIs in the same order; an agent chooses tools based on its inputs, which can be manipulated through prompt injection. That changes several design decisions.
Give Every Agent a Distinct, Registered Identity
Microsoft’s Cloud Adoption Framework guidance on agents recommends a unique identity per agent and an agent registry recording owner, purpose, platform and access scope, with Microsoft Entra Agent ID serving as the authoritative source where available. The same principle applies on any cloud: no agent should run under a shared service account or a developer’s personal credentials.
Distinguish Acting as Itself From Acting for a User
When an agent performs work on behalf of a person, it should use delegated, scoped tokens that carry the user’s permissions, so it cannot reach data the user could not. When it acts autonomously, its own identity should have narrowly defined permissions. Mixing the two, such as an assistant holding broad standing access “to be helpful,” is a common and dangerous shortcut.
Broker Tool Credentials Through a Gateway
Agents increasingly reach tools through the Model Context Protocol. Rather than embedding downstream credentials in each agent, route calls through an MCP gateway that authenticates the agent, applies tool-level policy and holds or exchanges the credentials for upstream systems. This keeps secrets out of prompts and memory, where they could be exfiltrated.
Constrain Write Actions
Start agents with read-only permissions and add write capabilities individually, with human approval for irreversible or high-value actions. Map each tool to the minimum permission it needs, and review those mappings as tools evolve.
Plan for Revocation
Every agent should have a tested kill switch: disable the identity, revoke tokens, stop queued work and preserve logs. Microsoft’s guidance explicitly calls for incident response plans that cover disabling a malfunctioning agent.
A Step-by-Step NHI Security Program
Step 1: Discover and Inventory (Weeks 1–6)
Pull identities from every cloud’s IAM, Kubernetes clusters, CI/CD platforms, secret stores, SaaS OAuth grants and AI platforms. Scan code repositories and pipeline logs for hard-coded secrets. Correlate everything into a single inventory with metadata: owner, purpose, environment, last used, permissions and credential type. Expect the first pass to be messy; naming conventions differ by team and cloud, and many identities will only be explainable after conversations with the engineers who created them. Record what you learn in the inventory so the effort is not repeated, and treat the inventory as a living system fed automatically rather than a one-off spreadsheet.
Step 2: Triage the Riskiest Identities (Weeks 4–10)
Prioritize using a simple risk lens: high privilege, long-lived static credentials, no owner, unused for 90 days or more, exposed secrets, or use from unexpected locations. Remove dormant identities, rotate exposed secrets immediately and assign owners to the rest.
Step 3: Eliminate Static Secrets Where Possible (Months 2–6)
Move CI/CD pipelines to workload identity federation so they obtain short-lived cloud credentials without stored keys. Replace application access keys with managed identities or IAM roles. For databases and third-party APIs that still need secrets, use a vault with dynamic or automatically rotated credentials.
Step 4: Right-Size Permissions (Months 3–9)
Use entitlement analysis, from your CNAPP’s CIEM module or cloud-native access analyzers, to compare granted permissions with actual usage, and remove the excess. Enforce guardrails through organization policies, such as banning the creation of long-lived user access keys.
Step 5: Govern the Lifecycle (Ongoing)
Require identities to be created through infrastructure as code linked to a workload and an owner. Add NHIs to access reviews, focusing owners on what changed. Deprovision identities automatically when workloads are decommissioned. Extend the same process to agents through the agent registry.
Special attention belongs to the OWASP item “human use of NHI.” Engineers sometimes borrow a service account’s credentials to get around access controls or to debug production. Detect interactive logins and console sessions by non-human identities, provide a legitimate break-glass path with approval and logging, and treat repeated misuse as a process problem to fix rather than a habit to tolerate.
Step 6: Detect and Respond (Ongoing)
Send identity activity to your SIEM, baseline normal behavior and alert on anomalies. Build playbooks for leaked keys, unusual API usage, privilege escalation and suspicious agent tool calls. Rehearse them: the speed at which a team can identify the owner of a leaked credential, revoke it and confirm nothing broke is one of the best indicators of NHI program maturity.
Tooling and Metrics
No single product covers the whole problem, but the tooling landscape has matured. Most programs combine several categories:
- Cloud-native identity services: managed identities, IAM roles, workload identity federation and access analyzers in each cloud provide the foundation and should be used before anything else.
- Secrets management: a vault for the secrets that remain, with dynamic credentials and automated rotation.
- Secret scanning: pre-commit hooks and repository scanning to stop new leaks and find old ones.
- CIEM within a CNAPP: effective-permission analysis across clouds and correlation with workload exposure.
- Dedicated NHI security platforms: inventory and lifecycle management across cloud, SaaS and CI/CD, an area that has grown rapidly alongside agentic AI.
- Agent identity services and gateways: registries, agent identities and MCP gateways that bring agents under the same controls.
To show progress and keep momentum, track a small set of metrics: the share of NHIs with a named owner; the number of long-lived static credentials (trending toward zero); the percentage of pipelines using federated authentication; the ratio of granted to used permissions for production roles; the number of dormant identities older than 90 days; mean time to revoke an exposed secret; and the share of AI agents registered with distinct identities. Report them alongside human identity metrics so leadership sees the full picture.
Ownership is the metric that unlocks all the others. An identity with an accountable team can be reviewed, right-sized and retired; an orphaned one cannot. Make ownership mandatory at creation time, enforce it with policy, and reassign identities promptly when teams reorganize or people leave, otherwise the inventory decays within months.
A Worked Example: Cleaning Up a Multicloud Estate
Consider a hypothetical SaaS company running on AWS and Azure with about forty engineering teams. An inventory exercise finds several thousand non-human identities, far more than the security team expected. A significant share has not been used in months, many service principals have no recorded owner, and secret scanning turns up live cloud keys in old repositories.
The team revokes the exposed keys first, then disables dormant identities in stages with a short waiting period before deletion, to catch hidden dependencies. Pipelines are moved to OIDC federation over two months, eliminating most long-lived deployment keys. Entitlement analysis shows that most production roles use only a small fraction of their granted permissions; roles are tightened team by team. Finally, the company’s new customer-support agent is designed from the start with its own identity, delegated user tokens for customer data, read-only tools by default and an MCP gateway that brokers all downstream credentials. Within a year, the security team can answer, with evidence, which machines and agents can touch production and why.
Pitfalls to Avoid
- Treating NHIs as an IAM side project: they need executive sponsorship and engineering time, not just a new tool.
- Mass deletion without staging: disabling identities abruptly can break critical integrations; stage changes and monitor.
- Rotating secrets but keeping them static: rotation helps, but eliminating secrets through federation is better.
- Ignoring SaaS and OAuth grants: third-party integrations are a frequent entry point, as the OWASP list notes.
- Letting agents inherit broad service accounts: agents need distinct identities and narrow scopes from day one.
In the cloud, every workload, pipeline and AI agent is an identity. Inventory them, give each a single owner and purpose, replace static secrets with short-lived federated credentials, and grant only the permissions they actually use.
Conclusion: Identity Is the New Perimeter for Machines Too
Zero trust programs made identity the perimeter for people. The same shift is now overdue for machines. Non-human identities typically outnumber human users by a wide margin in cloud environments, and AI agents are accelerating that growth while adding nondeterministic behavior. The OWASP NHI and agentic Top 10 lists provide a shared vocabulary, and cloud platforms offer the building blocks: managed identities, workload federation, entitlement analysis and agent identity services. Organizations that inventory, de-secret, right-size and govern their machine identities now will be far better positioned to adopt AI agents safely, and far harder targets for attackers looking for the easiest way in.
How Hanoi Technology Can Help
Hanoi Technology helps organizations inventory and secure non-human identities, move pipelines to secretless authentication and design least-privilege identity for AI agents across major clouds.
Further Reading
- Introducing the OWASP NHI Top 10 – Cloud Security Alliance
- OWASP Drops First AI Agent Risk List – TechRepublic
- AI Agents and Non-Human Identities Creating Critical Security Gaps, Research Warns – Hackread
- Governance and security for AI agents across the organization – Microsoft Learn
- MCP Gateway reference architecture – Speakeasy