The philosopher Gilbert Ryle coined the phrase “ghost in the machine” back in 1949 to critique the idea that mind and body were separate, coexisting forces. In cybersecurity today, that same philosophy feels uncannily apt – not to describe the metaphysical, but the operational. Our networks are now haunted by an invisible workforce: non-human identities (NHIs) that log on, carry out tasks, make decisions, and interact with critical systems without ever being seen. Service accounts, bots, automation scripts, AI agents, and independent containers now significantly outnumber human users. According to the Non-Human Identity Management Group, an independent authority in NHI risk assessment, the number of NHIs on the average network is up to 50 times greater than the number of humans. We are outnumbered.
While Identity and Access Management (IAM) has evolved to keep humans in check, these machine counterparts are often left to operate outside the perimeter of scrutiny, hidden from the watchful gaze of even the most advanced identity governance tools. This was once a fringe concern, but now it’s shaping up to be this generation’s defining identity security issue. Every organization is building, buying, or deploying systems that rely on non-human access. But in the rush to enable automation, many have overlooked the consequences of unchecked machine-to-machine interaction. These NHIs aren’t just growing in number; they’re growing in complexity, acting autonomously, spawning temporary credentials, and accessing sensitive resources at scale. And unlike humans, they don’t forget passwords or ignore MFA prompts. They work perfectly – until they don’t. The ghosts are already in the machine. The challenge now is figuring out how to govern them.
Herding ghosts
Whether they know it or not, every enterprise has a non-human identity problem. APIs, bots, machine learning pipelines, RPA tools, CI/CD workflows, and cloud services all rely on machine accounts to function. We know that these identities now outnumber human identities to a concerning degree, but where human identities are typically tied to a name, role, and manager, NHIs tend to exist in abstraction: short-lived, unowned, and unaudited. What makes them powerful – speed, flexibility, repeatability – also makes them dangerous. The result is a sprawl of service accounts, tokens, and keys operating with minimal oversight across critical systems.
Traditional IAM tools simply weren’t designed with this kind of volatility in mind. According to one study, only 15% of organizations feel “highly confident” in preventing NHI-based attacks, while 69% are “concerned” about them moving forward. Only one in five organizations have any kind of formal process for offboarding and revoking API keys, and even fewer have procedures for rotating them. What’s emerging is a vast, shifting attack surface made up not of people, but of code – each instance a potential entry point if not properly governed.
Accountability up in smoke
In human identity governance, accountability is built into the system. Accounts are assigned, activity is monitored, and responsibility can be traced. With NHIs, that clarity dissolves. Who owns a service account that was auto generated by a deployment script? Who reviews the privileges of an API token embedded as part of a third-party integration? Accounting for these identities is like trying to catch smoke, and as processes become increasingly self-reliant, the chain of accountability doesn’t just break, it evaporates. Without clear ownership, there’s no one to review permissions, rotate credentials, or revoke access when something changes.
This ambiguity creates ideal conditions for misuse, whether accidental or malicious. Credentials can be recycled between systems without scrutiny, orphaned accounts can linger long after their purpose has expired, and developers under pressure can bypass good governance policy in the name of speed. Even when incidents occur, tracing them back to a specific non-human identity can be a forensic nightmare. The core issue isn’t just technical, it’s conceptual. Identity governance was designed for permanence – for people. But in a machine-speed world, access is temporary, fluid, and frequently untraceable unless new principles of ownership and auditability are put in place.
What good NHI governance looks like
One thing is abundantly clear: applying traditional IAM tools and policies for a machine world simply won’t cut it. These legacy systems aren’t designed to cope with the churn and volatility that a heavily machine-populated network brings. NHIs demand a high-performance identity service capable of provisioning, managing, and decommissioning accounts at a speed that matches the machine. It must support real-time policy enforcement, embed least-privilege access by default, and generate a complete audit trail for every machine identity, no matter how brief its lifespan. Without this level of automation and attribution, governance becomes guesswork, and every untracked identity becomes a liability. That means every API key, service account, and automation token must be accounted for, reviewed, and assigned clear ownership. Policies should dictate not only what an identity can access, but when, why, and for how long. Machine-to-machine trust must be earned, not assumed. Done right, governance at this level doesn’t slow the road to innovation, it simply adds road markings, CCTV, and signs to make the road safer to traverse.
The fabric of identity is changing
Securing non-human identities requires an architectural rethink. Identity must become an embedded layer across systems, services, and workflows, capable of dynamically enforcing policy regardless of whether the entity in question is a person or a process. This is where the concept of an “identity fabric” comes into play: a unified, interoperable layer that connects identity data, enforces access controls, and supports automated lifecycle management across cloud environments. For NHIs, that fabric must be extensible enough to handle everything from containerized workloads to AI-driven agents, and it must be able to do that without too much manual intervention because there simply aren’t enough humans to go around.
This requires full integration, but it also requires intelligence. Visibility into machine identities must be continuous and contextual, with risk-based policies that adapt in real time. Security teams should be able to detect anomalies in how NHIs behave, just as they do with humans, flagging unusual access patterns, privilege escalation, or cross-domain movement. Identity fabrics can provide this by monitoring activity across environments and enforcing rules consistently, whether identities are spinning up in container clusters or authenticating through serverless functions.
If every identity is a potential doorway, then every ungoverned non-human identity is an unlocked one. Innovation demands that we trust in the machines, but just like human entities, that trust must not be assumed or given freely. Machines are no longer second-class citizens; they’re active participants on our networks and must play by the same rules as everyone else.
Join our LinkedIn group Information Security Community!
