The non human identity problem in 2026 is the identity problem most organisations have not mapped. Service accounts, API keys, OAuth tokens, machine certificates, workload identities in Kubernetes, the long lived API credentials in legacy applications. The non human identity surface in 2026 is larger than the human one. According to the 2025 CyberArk identity security threat landscape report, the typical enterprise has roughly 45 machine identities for every human employee. Most of those identities are unmanaged. They have credentials that never rotate. They have access rights that were set at deployment and never reviewed. They are, in aggregate, the dominant credential attack surface in 2026, and almost nobody has mapped them.
What the surface actually looks like
Five categories, in roughly that order of volume. The first is service accounts. The Windows service account, the Linux daemon account, the database application account, the SAP dialog account. These accounts have been accumulating since the 1990s. They have passwords that nobody rotates because rotating them requires downtime. They have local administrator rights because that was the path of least resistance when the application was deployed. They are running critical workloads today. The second category is API keys. The AWS access key, the GitHub personal access token, the Stripe API key, the Google Maps API key. These are embedded in code, in CI pipelines, in cron jobs, in infrastructure as code. They have lifetime measured in years. They are checked into git repositories. The third category is OAuth tokens and refresh tokens. These have lifetimes measured in months, with refresh tokens that can extend the lifetime indefinitely. The token, once stolen, is good until it expires. The fourth category is machine certificates. The TLS server certificate, the client certificate, the S/MIME certificate, the code signing certificate. These rotate on a schedule that is harder to manage than human credentials, and the rotation is often automated in a way that loses track of which certificate belongs to which system. The fifth category is workload identities in the cloud. The AWS IAM role, the Azure managed identity, the GCP service account, the Kubernetes service account token. These are tied to the workload, not the human, and they inherit the access rights that the workload needs, which is often far more than the workload should have.
Why this matters in 2026
Two reasons. The first is the credential attack surface. An attacker who steals a service account password has the same access as that service account, which is often local administrator on a domain joined machine. An attacker who steals an AWS access key with iam:full access has the keys to the kingdom. An attacker who steals a Kubernetes service account token can pivot to every pod in the namespace. The non human identity, once compromised, gives the attacker the persistence and the privilege that the human identity would not. The second reason is the regulatory and insurance exposure. The SEC disclosure rules in 2024, the DORA regulation in the EU in 2025, and the cyber insurance underwriting questionnaires in 2026 all ask about non human identity management. The organisation that cannot answer has a disclosure problem and an insurance problem in addition to the security problem.
What to actually do
Three moves, in priority order. The first is inventory. Use a tool like Venafi, CyberArk, or the open source alternatives (HashiCorp Boundary, the cloud native identity discovery tools) to enumerate every machine identity in the environment. The first run will produce a list longer than the security team expected. The second is credential rotation. The credentials that have not been rotated in over a year are the priority. Replace static API keys with short lived tokens, where the cloud provider supports it (AWS IAM roles, Azure managed identities, GCP workload identity federation). The third is access review. The non human identity that has access it does not need is the highest risk. The least privilege work that the security team has been putting off for human identities is more urgent for non human identities.
The bottom line
Inventory, rotation, access review. The non human identity surface is the largest credential attack surface in 2026 and almost nobody has mapped it. The first run produces a list longer than expected. The work is not glamorous. The work is necessary.
Sources & Further Reading
All claims in this article are sourced from primary documentation, vendor advisories, and reputable security researchers.
Spotted an error? Email the editor. Corrections are issued with a visible correction note.
Editorial standards. Every article on humanrequired.org is reviewed by a human editor before publication. AI may assist with drafting or research; final editorial control is human. Read the full standards.
