CIOs must rethink identity now people are being outnumbered by nonhuman entities

Identity is the fundamental currency in any technology transaction so we need to treat nonhuman assets with the same care as we apply to people.

We’re outnumbered! Nonhuman identities (NHIs) outnumber human identities in the enterprise by a ratio of up to 50:1. This Non-Human Identity Management Group statistic from 2025 is likely already outdated, and in a year from now the ratio will be exponentially higher as rapid growth trends like AI/Machine Learning, the Internet of Things, digital assistants and the burgeoning API Economy continue to accelerate automation.

What are NHIs? Machines, processes, service principals and accounts, virtualized and other workloads, and applications that are granted digital credentials. Think, for an everyday example, of a helpdesk chatbot on your favorite website.

Managing NHIs is a challenge that CIOs, identity experts, and CISOs must accept. This in some ways is a re-run of what happened 40 years ago when identity access management was widely deployed. It’s just that now we are not only dealing with human beings. And I don’t know a single organization that has its collective head around the concept of who is, or should be, ‘the HR chief’ for NHIs.

Leaders today need to consider nonhuman identity in the way they consider human identity. When we hire, we onboard people by harnessing and securing the details we need to pay them and manage them, but we also work to imbue them with our organizational culture, systems, risks, security processes and so on.

We set and tweak permissions based on who needs access to what and when, depending on their roles, seniority, specific tasks they perform at a given time and so on. We need to have similar controls and contextual understanding of our nonhuman assets.

An urgent case where context is king

Without making that change CIOs and other leaders will have no foundational basis of understanding where risks are coming from or what measures they need to take. They need a central, visible platform to see what they have and what’s going on. Legacy IAM can’t offer that because it starts with a narrow focus on compliance and is a static model based on rigid criteria like six-month audits and the rote dispensing of permissions and privileges.

The old IAM is rooted in the early-21st-century age of Sarbanes-Oxley, reactions to governance scandals and corporate malfeasance. Moreover, it ignores what is happening in the wider digital world: namely, the explosion of identity types that are crying out for holistic oversight.

Control of the human and nonhuman estate means ensuring there is insight into nonhuman assets and what they’re doing.. context is king. So look at NHI constructs that can touch anything in the digital ecosystem and the underlying connectivity to apps and, most importantly, data. CIOs need to be able to recognize the truth of a contemporary mantra: identity is the fundamental currency in any technology transaction.

Everything must be covered: bots; service principals; IoT endpoints; abandoned trial workloads; autonomous agents and agents that speak to other agents. Start by asking an overarching question: do these NHIs leverage a human identity when they perform tasks on behalf of that person, and is that appropriate?

Then it is possible to drill into practical areas like guarding against credential misuse across agents, improving digital and identity hygiene by spotting risks relating to non-expiring tokens, and analyzing API access levels on a just-in-time basis.

ISPM (Identity Security Posture Management) is useful here because organizations need to have a handle on what they have, and must bring identity constructs together. However, this is not a ‘one and done’ discovery process so consider it as a CI/CD journey of continuous improvement.

In the AI era, holistic technology inventory can’t be CMDB-based but must be dynamic and based on CI/CD pipeline control frameworks that let us dynamically view and slice and dice data and assets by controlling who is using what and where.

Think of it as an opportunity…

It’s a complex task and we are all busy. But we need to pause and think about how this inflection point can be parlayed into a positive. This is an opportunity for the security and identity teams to start asking ourselves about the constructs we can apply to nonhuman identities.

They should be asking what needs to be added to legacy IAM frameworks to be successful. And usually the answer will be to replace them with systems that are coded for the current age, not the previous one.

By providing these new controls the identity team will become respected and sought out. Identity leaders will gain kudos by their ability to attribute risk ratings based on behavioral analytics and business function.

By demonstrating insights into where data sits, where it moves to and from, and how identity supports that, identity leaders can deliver qualitative and quantitative process analysis. In some cases of outperforming best practices and execution, they will even help to refine business process re-engineering through a platform that informs prioritization and budget management.

We’ve featured the best IT management tool.

This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit