Non Human identity attestation is the work of knowing what every service account, every API key, every bot identity, and every machine credential can do, who owns it, when it was last used, and whether it is still needed. Most enterprises in 2026 have not done this work. The attackers know. The auditors are catching up. The gap is where the next breach is coming from.
The 2024 Snowflake credential reuse wave hit enterprises that had not done the work. The 2025 PAN token theft wave hit enterprises that had not done the work. The 2026 Okta support account compromise wave hit enterprises that had not done the work. Every one of these incidents was a non human identity problem. Every one of them was an attestation failure. The pattern is not subtle.
What non human identity attestation actually is
Five stages, in order of maturity. Discovery: the defender runs a tool that finds every service account, every API key, every bot, every machine credential, every OAuth application, every personal access token, every cloud workload identity. The list is long. The list is the starting point. Owner assignment: every identity has a person who is accountable for it, not a team, not a distribution list, a person. Purpose documentation: the owner documents what the identity does, who needs it, what it has access to, when it was last used. Access review: the owner reviews the access, removes what is not needed, tightens what is. Credential rotation: the credentials get rotated on a schedule, with the rotation tracked, with the rotation verified. The 5 stage process is what the typical enterprise has not done.
Why the typical enterprise has not done it
Three reasons, in order of how often they come up. The discovery problem: the tooling to find every non human identity is immature, the defender does not know what they have, the defender cannot attest what they cannot see. The ownership problem: the identities were created by developers who have since left the organisation, the team that owns them has changed three times, the documentation is missing, the ownership is unclear. The priority problem: the security team has a backlog of work, the attestation work is not on fire, the work gets pushed to next quarter, the work gets pushed to next year. The next breach is the one that finally puts the work on the priority list.
How to do the work
Three moves if you are starting the attestation program. Pick a discovery tool that works in your environment (the cloud native identity tools, the SaaS identity tools, the legacy Active Directory tools, the open source alternatives), run it, get the list. The list is the foundation. Assign owners, even if the assignment is provisional and gets revisited in 90 days. The assignment creates accountability, and accountability creates the work. Build the 5 stage process as a recurring cycle rather than a one time project, because the identities get created faster than they get retired and the cycle is what keeps the list current.
The bottom line
Non Human identity attestation is security work that 80% of the typical enterprise has not done. The 5 stage process is what needs to happen. The next breach will finally put it on the priority list. Starting the discovery today is the only move that matters.
Sources & Further Reading
All claims in this article are sourced from primary documentation, vendor advisories, and reputable security researchers.
Spotted an error? Email the editor. Corrections are issued with a visible correction note.
Editorial standards. Every article on humanrequired.org is reviewed by a human editor before publication. AI may assist with drafting or research; final editorial control is human. Read the full standards.
