Non-Human Identities

Non-human identities are the credentials and accounts used by software rather than people, including API keys, service accounts, OAuth tokens, and AI agents that act on a company's systems. As businesses deploy more autonomous AI agents, these identities multiply quickly, often outnumbering human staff and frequently lacking the owners, expiry dates, and access reviews that human accounts receive. For compliance and risk teams, the central questions are who controls each non-human identity, what it is allowed to do, and whether its activity can be traced and audited.

1 item

ResearchGlobal2026-11-05

Six-Hour Cloud Heist Shows Enterprise Identity Controls Cannot Keep Up With AI Agents

A SecurityWeek analysis documents a real incident in which a multi-agent AI system executed a credential-harvesting attack inside a cloud environment in under six hours. Standard identity and access management tools are built for human users. They are fundamentally unsuitable for AI agents that spin up in milliseconds and inherit broad human credentials. Recommended controls include agent-specific short-lived credentials, AI component inventories for provenance tracking, and human sponsorship models to maintain accountability.

agentic AI identity governance non-human identities credential security cloud security AI risk Google Threat Intelligence Group