3 MIN READ
Non-human identity attestation is the work of knowing what every service account, every API key, every bot identity, and every machine credential can do, who owns it, when it was last used, and whether it is still needed. Most enterprises in 2026 have not done this work. Attackers know. Auditors are catching up. The gap is where the next breach is coming from.
The 2024 Snowflake credential reuse wave hit enterprises that had not done the work. The 2025 PAN token theft wave hit the same. The 2026 Okta support account compromise wave hit the same again. All three were non-human identity problems, every one of them an attestation failure. The pattern is not subtle.
What non-human identity attestation actually is
Five stages, in order of maturity. Discovery runs a tool that finds every service account, every API key, every bot, every machine credential, every OAuth application, every personal access token, every cloud workload identity. The list runs long. The list serves as the starting point. Owner assignment puts a real person on every identity. Not a team, not a distribution list, a person. Purpose documentation captures what the identity does, who needs it, what it has access to, when it was last used. Access review cleans up what is no longer needed and tightens what remains. Credential rotation runs on a schedule, with the rotation tracked and the rotation verified. The five stage cycle is what most enterprises have never put in place.
Why the typical enterprise has not done it
Three reasons, in order of how often they come up. The discovery problem first. The tooling to find every non-human identity is immature, the security org does not know what they have, and they cannot attest what they cannot see. The ownership problem second. Most of the identities were created by developers who have since left the organisation. The team that owns them has changed three times. The documentation is missing, and the ownership is unclear. The priority problem last. The security org has a backlog of work. Attestation is not on fire, so it gets pushed to next quarter, then to next year, then to the post mortem of the next breach. That post mortem is the thing that finally puts the work on the priority list.
How to do the work
Three moves if you are starting the attestation program. Pick a discovery tool that works in your environment, the cloud native identity tools, the SaaS identity tools, the legacy Active Directory tools, the open source alternatives. Run it. Get the list. The list is the foundation. Assign owners, even if the assignment is provisional and gets revisited in 90 days. Assignment creates accountability, and accountability creates the work. Build the five stage process as a recurring cycle rather than a one time project, because identities get created faster than they get retired, and the cycle is what keeps the list current.
The bottom line
Most enterprises have not done the work, and the next breach is the thing that finally puts it on the priority list. Run discovery today, assign owners within 90 days, build the five stage process as a recurring cycle. The order is what matters. The work is not glamorous. The work is what keeps the next breach off the front page.
Sources & Further Reading
All claims in this article are sourced from primary documentation, vendor advisories, and reputable security researchers.
Spotted an error? Email the editor. Corrections are issued with a visible correction note.
Editorial standards. Every article on humanrequired.org is reviewed by a human editor before publication. AI may assist with drafting or research; final editorial control is human. Read the full standards.
