Non-human identity security has moved from a niche IAM concern to one of the most pressing gaps in enterprise defense - and most organizations are only beginning to grasp the scale of the problem. API keys, service account tokens, machine certificates, and OAuth credentials now outnumber human user accounts by a ratio of at least 45-to-1 in the average large enterprise, according to Rubrik Zero Labs data cited by Oasis Security in August 2025. In some environments, GitGuardian's State of Secrets Sprawl 2025 report puts that ratio as high as 144-to-1. Agentic AI systems are making the arithmetic worse by the week.
Sources: Rubrik Zero Labs cited by Oasis Security / NHI Management Group (Aug 2025); GitGuardian State of Secrets Sprawl 2025 (Apr 2025); GitGuardian SecDays Virtual 2025 (Jul 2025)
| Value (machine identities per human account) | Machine identities per human account |
|---|---|
| Rubrik Zero Labs avg | 45 machine identities per human account |
| Rubrik Zero Labs ceiling | 100 machine identities per human account |
| GitGuardian SecDays est. | 100 machine identities per human account |
| GitGuardian Secrets Sprawl ceiling | 144 machine identities per human account |
How machine identity sprawl reached this scale
Modern enterprise infrastructure is built on automation. DevOps pipelines, microservices architectures, cloud-native workloads, and SaaS integrations each depend on credentials that authenticate machines to machines, with no human in the loop. Every new service, function, or integration typically gets its own API key or token. Multiply that across a large organization's cloud accounts, CI/CD toolchains, and third-party integrations and the count climbs into the hundreds of thousands quickly. GitGuardian's April 2025 report documented environments where machine credentials outnumbered human accounts by 144-to-1, while Rubrik Zero Labs placed the typical large-enterprise ratio at 45-to-1, with many organizations exceeding 100-to-1.
The compounding factor is persistence. GitGuardian found that 70 percent of valid secrets - API keys, tokens, and service account credentials - detected in public repositories in 2022 were still active and unrotated three years later in 2025. These are not expired artifacts. They are live credentials, sitting in code repositories, CI logs, and container images, available to anyone who looks. The combination of volume and longevity creates an attack surface that dwarfs the traditional human identity perimeter that most IAM and PAM programs were designed to protect.
70 percent of valid secrets detected in public repositories in 2022 were still active and unrotated three years later, in 2025 - according to GitGuardian's State of Secrets Sprawl report.
Agentic AI is the accelerant CISOs did not plan for
The governance challenge was already serious before agentic AI entered the picture. It is now escalating at a pace that outstrips most enterprise tooling. When an AI agent autonomously spins up a sub-task, it often generates a new machine identity to authenticate that action - and then another for the next task, and another for any downstream service it calls. GitGuardian's SecDays Virtual 2025 event in July 2025 brought together practitioners from vendors including Akeyless, Aembit, and Vermeer specifically to discuss what speakers called an 'NHI Governance Vacuum': agentic systems are creating identities faster than discovery tools can catalog them or administrators can revoke them.
GitGuardian's forthcoming 2026 edition data, cited by NHI Management Group in August 2025, found that 70 percent of identity-related incidents in agentic AI environments were linked to autonomous AI activity specifically. These are not cases where a developer leaked a credential. These are cases where an AI pipeline minted a credential, used it briefly, and left it live and ungoverned. At the Gartner IAM Summit in December 2024, non-human and machine identity management was named a top identity trend for 2025 - a forecast that has since been validated by a wave of practitioner reporting and breach data.
The breach record is already accumulating
The risk is not theoretical. The Hacker News reported in June 2025 that 46 percent of enterprises had experienced a breach tied directly to a non-human identity in the prior 12 months. Separately, data cited at the Gartner IAM Summit placed more than 80 percent of all identity-related breaches at compromised non-human identities - service accounts, API keys, and machine tokens - rather than stolen human passwords. Dark Reading has framed the collective population of ungoverned machine identities as 'an invisible army' operating inside enterprise perimeters with credentials that typically carry elevated privileges and sit outside MFA controls entirely.
GitGuardian's 2025 report named specific high-profile incidents as starting with a leaked or unmanaged machine credential: breaches affecting the U.S. Department of the Treasury, Toyota, and The New York Times each traced back to an API key or service account that was either publicly exposed or inadequately governed. The pattern is consistent - elevated privilege, no rotation policy, no anomaly detection, and no owner who was actively watching the credential. That is the default state for a large share of the NHI population in most enterprises today.
What IT leaders need to do differently
The practical gap is in discovery before anything else. Most security teams cannot produce a complete inventory of the machine identities operating in their environment, let alone flag which are dormant, over-privileged, or owned by a system or vendor that no longer exists. Traditional PAM tools were built to vault human credentials and enforce approval workflows; they were not designed to ingest hundreds of thousands of ephemeral tokens or classify the entitlements of an AI agent's service account in real time.
CISOs responding to this gap are taking several concrete steps. First, extending discovery tooling specifically to cover secrets in source code repositories, CI/CD pipelines, and cloud IAM configurations - GitGuardian, Trufflesecurity, and similar tools address this layer. Second, applying zero-trust principles to machine identities the same way they apply to human accounts: least-privilege entitlements, short-lived credentials where possible, and automated rotation enforced by policy rather than manual process. Third, building NHI lifecycle management into the AI development pipeline itself, so that agentic systems cannot create persistent credentials without registering them in a governed inventory. More than 80 percent of organizations told researchers they plan to increase security spending on NHI management, according to The Hacker News reporting from June 2025 - but spending alone does not close the gap if the governance model has not been rethought first.
