Non-Human Identities Outnumber Humans, Challenging Legacy Access Controls
Enterprises face a growing governance crisis as non-human identities, such as AI agents, now exceed human ones, overwhelming traditional access management systems.
The proliferation of non-human identities (NHIs) within enterprise environments has reached a critical juncture, with these automated entities now outnumbering their human counterparts. This seismic shift presents a significant challenge to legacy access management systems, which were designed primarily to govern human logins and permissions. Darren Guccione, CEO and co-founder of Keeper Security, highlighted this growing disparity and its implications for cybersecurity at the Black Hat 2026 conference.
Guccione explained that existing privileged access tools are ill-equipped to handle the complexities of NHIs. These tools were built with IT administrators and human users in mind, not the dynamic and often autonomous operations of CI/CD pipelines, secret rotation processes, or Kubernetes cluster management. As NHIs have rapidly integrated into core business functions, security teams have lost crucial visibility into what is running within their infrastructure, creating a fertile ground for potential security breaches.
The core of the problem lies in the inability of current systems to adequately track, verify, and govern these non-human entities. Unlike human users who have established identity and access management (IAM) protocols, NHIs often operate with broad permissions and less stringent oversight. This lack of governance means that enterprises may not know the full extent of what these agents can access or the actions they are performing, posing a significant risk to sensitive data and critical systems.
Keeper Security advocates for a unified identity governance platform as the solution to this escalating challenge. This platform would assign a unique, trackable, and auditable profile to every identity, whether human or non-human. By consolidating governance under a single pane of glass, organizations can regain visibility and control over their entire digital estate, ensuring that all entities, regardless of their nature, adhere to security policies.
Furthermore, Guccione emphasized the need for cybersecurity funding to be a board-mandated initiative rather than solely a CISO-owned responsibility. This elevated focus is crucial for securing the necessary resources to implement advanced solutions like unified identity governance and quantum-resistant encryption. The board's direct involvement ensures that identity management, especially in the context of rapidly evolving AI, is treated as a strategic business imperative.
Beyond identity governance, the conversation also touched upon the imperative of adopting quantum-resistant encryption. As artificial intelligence capabilities advance, so too does the potential for AI-powered attacks. Quantum computing, when it matures, could render current encryption methods obsolete, making the transition to quantum-resistant algorithms a necessary step to future-proof security defenses against sophisticated threats, including those orchestrated by advanced AI.
The implications of unmanaged NHIs extend to the potential for sophisticated cyberattacks. Without proper controls, compromised NHIs could be leveraged for malicious purposes, such as unauthorized data exfiltration, system manipulation, or even as entry points for broader network intrusions. The speed and scale at which NHIs operate amplify the potential impact of any security lapse.
In essence, the rise of non-human identities necessitates a fundamental rethinking of enterprise security architectures. Organizations must move beyond traditional human-centric access models and embrace comprehensive identity governance solutions, coupled with forward-looking encryption strategies, to effectively manage and secure their increasingly automated environments.