Lead Image © ARMMY PICCA, 123RF.com

Identity for Machines, Workloads, and Agents

Digital Colleagues

Article from ADMIN 92/2026

By Martin Kuppinger

Many non-human identities – workloads in the cloud, service accounts in IT systems, autonomous agents in AI applications – are poorly managed or not managed at all. We present a strategic, holistic approach to managing these identities.

Non-human identities (NHIs) are not a new phenomenon, but they are rapidly becoming increasingly prevalent and complex. NHIs include identities for workloads, services, Internet of Things (IoT) devices, machines, and, increasingly, autonomous artificial intelligence (AI) applications. Studies and observations in corporate environments show that NHIs exceed the number of human identities many times over: Ratios of 40:1 to 80:1 have been reported. Whether or not these numbers are accurate, clearly NHIs give rise to an identity and access management (IAM) and cybersecurity problem of a considerable magnitude, giving rise to a variety of security risks and prompting the need for automation.

The challenge lies not only in the sheer numbers. NHIs are often created automatically, for example, as part of continuous integration and continuous delivery (CI/CD) pipelines or through instances of Kubernetes pods. Their lifespans can range from a few seconds to several years, and their privileges range from simple read access to comprehensive administrative rights.

The majority of today's NHIs are either unknown or work with static access credentials that do not change over long periods of time. This combination of opacity and permanent authorizations creates a massive attack surface that classic strategies in the area of IAM do not address. The strategies currently in place only consider human identities and a small subset of NHIs – the technical and functional user accounts managed by privileged access management (PAM; i.e., service and system accounts to be more precise).

Management of Non-Human Identities

Different terms are sometimes used synonymously with the umbrella term "non-human identity management" for strategies, technologies, and processes, and sometimes specific sub-areas (Table 1).

...

Use Express-Checkout link below to read the full article (PDF).