“Every company adopts software solutions to be successful and to be more agile. With the proliferation of AI agents, NHIs are just going to scale,” says Vijay Pitchumani, director of product management at Okta.
As more businesses, including small businesses, rely on NHIs in automated workflows, the AI agents represent a potential security risk that malicious actors can exploit. Here’s how IT leaders can reconsider their IAM strategy to include NHIs, not separate from human identities but as part of a holistic approach.
READ MORE: Data governance is not just a tech issue, it’s a human challenge.
The Differences Between Managing Human Identities and NHIs
Previously, human users generally have had constrained levels of access to certain applications and resources, Pitchumani notes. Now, however, NHIs are having elevated levels of access and are being set up at a large scale.
Some reports have found that NHIs outnumber human users by 45 to 1, with larger enterprises likely having fleets of NHIs that number in the tens of thousands.
“NHIs as a whole have a significantly higher level of access to enterprise resources than human identities,” Pitchumani says. “The volume of NHIs — or the amount of service accounts, API keys and credentials — that exist is exponentially higher than the volume of human identities to manage. When you think about the scale and the level of access they have, it just becomes increasingly complex to manage more NHIs as opposed to human identities.”
Part of that complexity is that NHIs don’t behave the way human identities so. For example, when human users try to access a system, they may use a smartphone for multifactor authentication beforehand, for instance. NHIs, however, often don’t have to go through MFA to log in to a system — a fundamental difference, Pitchumani says.
DISCOVER: Follow these AI data governance strategies for success.
Adapting IAM to Include NHIs
How can businesses discover NHIs across their systems, including in Software as a Service applications and on-premises locations? This is a major question for IT teams because they cannot control or govern what they cannot see.
“Discovery is a foundational piece in first bringing into management all of these NHIs,” Pitchumani says. “An AI agent might try to authorize and get access to an NHI at any point, so how do you dynamically discover all of these identities and bring them under management?”
One way is through credential rotation, to ensure that any NHI that's created automatically has its access regularly changed in a set interval so that it’s more secure.
Another is to implement the principle of least privilege: NHIs should only have the appropriate permissions to complete the specific tasks they’re made for instead of super-administrative access across an entire environment. Reducing the privileged access these NHIs have can significantly reduce a business’s threat exposure.
