Non-human identities pose big risks, cybersecurity pros warn - TechTarget
Non-human identities are expanding the attack surface exponentially, with machine identities outnumbering human ones by as much as 144:1 by mid-2025, cybersecurity experts warn.
Non-human identities are quietly proliferating across enterprises, expanding the attack surface at an exponential rate. Threat actors are paying attention, experts warn, and CISOs should do the same.
In March 2025, a third-party GitHub Action used in more than 23,000 repositories began dumping users' secrets into workflow logs in public repositories. No one was phished, and the attacker never logged in. Rather, the tj-actions compromise hinged on a personal access token that a threat actor stole from a bot.
You see the ripple effect here, right? It's a chain of trust, and every single identity in that chain could be a potential entry point.
Growing risk landscape
That chain of non-human identities grows longer by the day, introducing growing risk to enterprises. By mid-2025, machine identities outnumbered human identities by as many as 144:1, a 44% year-over-year increase, according to research from Entro Labs.
Even organizations that rigorously govern human identities often overlook service accounts, API keys, PATs, CI/CD runners, workload identities and AI agents. Unlike human identities, many NHIs have indefinite access, static secrets and over-scoped permissions, with little to no human oversight or ownership.
A good identity security system at Hugging Face could have prevented the level of access that OpenAI's agent had to its systems — even if it could not have prevented the initial breach.
Breaking the attack chain
Balasubramanian and Gattu described a six-stage NHI pipeline attack chain: discover, expose, acquire, exploit, escalate and persist. They urged security teams to immediately start inventorying every NHI in their environments, including CI/CD runners and AI agents.
The key principle of governance is to break the chain as early as possible, they emphasized. Security teams should document each NHI's purpose and assign it a human owner, turn on secret scanning and log masking, find tokens older than 90 days, and replace long-lived tokens with short-lived credentials.
Detection strategies
As a longer-term goal, the experts recommended building at least one detection signal per kill-chain stage, such as honeytokens, secret scanning alerts, unexpected token minting, unusual API calls and pipeline configuration edits.
The attacker has to successfully navigate through all six stages to successfully exploit us, Gattu noted. But for us, we only have to detect them at one stage and stop them. When it comes to NHI security, AI agents raise the stakes, Balasubramanian warned, adding: Do not let your AI agents impersonate human or non-human identities.
Related
