Non-Human Identity Security: Why Service Accounts and AI Agents Are Now the Main Way In
Attackers have found an easier door than your employees. A growing share of identity breaches now start with a service account or an AI agent that nobody is watching. That makes non-human identity security one of the most pressing gaps for IT and OT leaders heading into 2027.
The data backs this up. SpyCloud’s 2026 Identity Threat Report, released in September, surveyed 750 security leaders. Compromised non-human identities were the primary entry point for 31% of respondents. Phishing and social engineering came second at 17%. Misuse of non-human identities was also the most common identity event type, reported by 42% of organizations.
What Counts as a Non-Human Identity
A non-human identity is any credential used by software instead of a person. Think service accounts, API keys, OAuth tokens, certificates, and the credentials that AI agents use to act on your behalf.
In industrial environments the list is longer. Historians pull data from PLCs using stored credentials. MES platforms talk to ERP through integration accounts. Vendors often reach plant systems through shared remote access logins. Each of these is an identity, and each can be stolen.
The scale is hard to picture. At SailPoint’s Navigate conference in October, the company cited Palo Alto Networks research putting the ratio of non-human to human identities at 109 to 1. Service accounts made up 79% of them.
The Visibility Gap Is the Real Problem
Most organizations think they have this covered. The SpyCloud survey found that 95% believe they have adequate visibility into AI and non-human identity exposures. Yet only 36% actually monitor them.
That gap shows up in practice. At Navigate, SailPoint’s chief customer officer described a Fortune 500 company that said it had no AI agents. Discovery turned up 10,000 of them. Many had standing admin privileges.
Ownership is the other weak spot. SpyCloud found that 91% of organizations use AI tools or agents with access to internal systems or data. Only 56% have formal governance and ownership of those privileges. When an account has no owner, nobody rotates its secrets or removes it when the project ends.
Why AI Agents Raise the Stakes
Service accounts have been a quiet risk for years. AI agents change the speed of that risk.
An agent can chain thousands of actions in seconds. SailPoint’s chief product officer described one test where an agent reached cluster admin access in under a second. It got there by running 14,000 actions and coordinating with other agents.
Agents also tend to look for workarounds. SailPoint’s CTO said agents most often go rogue when they hit a missing permission midway through a task. They then search for another way in. If an exposed credential is sitting in a config file or a repo, the agent may find it and use it.
For OT teams, this matters even if no agent touches the control network today. Agents are being connected to IT systems that already have paths into the plant. A broad service account on the IT side can become a bridge.
A Practical Plan for Non-Human Identity Security
You do not need a new platform to make progress. Start with the basics and build from there.
1) Run a discovery sweep
Inventory every service account, API key, token, and agent across both IT and OT systems. Check code repositories and CI/CD pipelines for hardcoded secrets. Include vendor and integrator accounts. Expect to find far more than you thought you had.
2) Assign a human owner to every identity
Each non-human identity should map to a named person or team. That owner approves its access and answers for its behavior. If no one will claim an account, treat it as a candidate for removal.
3) Cut standing privileges
Many service accounts were granted admin rights to make a project work quickly. Review them against what they actually do. Move toward just-in-time access for agents, where permissions are granted for a task and then expire.
4) Rotate and vault secrets
Store credentials in a secrets manager rather than in scripts or spreadsheets. Set rotation schedules and automate them where you can. Shared vendor logins into OT systems deserve special attention, since they are often never changed.
5) Monitor for exposure
Watch for your keys and tokens showing up in public repos or infostealer logs. SpyCloud found that organizations with visibility into stolen session cookies reported identity events at a lower rate than those without it. Pair that with behavioral monitoring so unusual activity from a service account triggers an alert.
6) Plan for third parties
SpyCloud found that nearly 40% of organizations lack a consistent process to confirm a third-party identity exposure was fixed. Build that check into vendor offboarding and incident response.
The Skills Behind the Work
This is not only a tooling problem. Non-human identity security needs people who understand IAM policy and how applications talk to each other. In industrial settings it also helps to understand how OT systems authenticate. That mix is rare. Many teams have strong IAM staff on the IT side but no one who has mapped the integration accounts running between the plant floor and the business network.
Hiring managers should look for candidates with hands-on experience in privileged access management and secrets management. Exposure to OT protocols or ISA/IEC 62443 is a strong plus for industrial roles.
Conclusion
Human identities got a decade of attention. Machine and agent identities now outnumber them by a wide margin, and attackers have noticed. The fix starts with knowing what exists and who owns it. From there, shrink privileges and keep secrets out of reach.
If you need IAM or identity security talent with real IT/OT experience, Converge Resources helps companies find it. Learn more at https://convergeresources.com/
