CIOs must rethink identity now people are being outnumbered by nonhuman entities

Date:
Fri, 28 Aug 2026 11:01:57 +0000

Description:
AI-driven nonhuman identities are growing, forcing CIOs to rethink security, access and identity management.

FULL STORY ======================================================================Copy link Facebook X Whatsapp Reddit Pinterest Flipboard Threads Email Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Subscribe to our newsletter Identity is the fundamental currency in any technology transaction so we need to treat nonhuman assets with the same care as we apply to people.

Were outnumbered! Nonhuman identities (NHIs) outnumber human identities in
the enterprise by a ratio of up to 50:1. This Non-Human Identity Management Group statistic from 2025 is likely already outdated, and in a year from now the ratio will be exponentially higher as rapid growth trends like AI/Machine Learning, the Internet of Things, digital assistants and the burgeoning API Economy continue to accelerate automation . Simon Gooch Social Links Navigation

Field CIO at Saviynt. What are NHIs? Machines, processes, service principals and accounts, virtualized and other workloads, and applications that are granted digital credentials. Think, for an everyday example, of a helpdesk chatbot on your favorite website. Latest Videos From TechRadar Watch full video here:

Managing NHIs is a challenge that CIOs, identity experts, and CISOs must accept. This in some ways is a re-run of what happened 40 years ago when identity access management was widely deployed. Its just that now we are not only dealing with human beings. And I dont know a single organization that
has its collective head around the concept of who is, or should be, the HR chief for NHIs.

Leaders today need to consider nonhuman identity in the way they consider human identity. When we hire, we onboard people by harnessing and securing
the details we need to pay them and manage them, but we also work to imbue them with our organizational culture, systems, risks, security processes and so on. You may like Not all AIs are equal so CIOs need to prioritize actions when assessing risks Artificial intelligence agents need access, not secrets Agentic security doesn't need a whole new definition you just need to
reframe what you already know

We set and tweak permissions based on who needs access to what and when, depending on their roles, seniority, specific tasks they perform at a given time and so on. We need to have similar controls and contextual understanding of our nonhuman assets. An urgent case where context is king Without making that change CIOs and other leaders will have no foundational basis of understanding where risks are coming from or what measures they need to take. They need a central, visible platform to see what they have and whats going on. Legacy IAM cant offer that because it starts with a narrow focus on compliance and is a static model based on rigid criteria like six-month
audits and the rote dispensing of permissions and privileges. Are you a pro? Subscribe to our newsletter Sign up to the TechRadar Pro newsletter to get
all the top news, opinion, features and guidance your business needs to succeed! Contact me with news and offers from other Future brands Receive email from us on behalf of our trusted partners or sponsors By submitting
your information you agree to the Terms & Conditions and Privacy Policy and are aged 16 or over.

The old IAM is rooted in the early-21st-century age of Sarbanes-Oxley, reactions to governance scandals and corporate malfeasance. Moreover, it ignores what is happening in the wider digital world: namely, the explosion
of identity types that are crying out for holistic oversight.

Control of the human and nonhuman estate means ensuring there is insight into nonhuman assets and what they're doing.. context is king. So look at NHI constructs that can touch anything in the digital ecosystem and the
underlying connectivity to apps and, most importantly, data. CIOs need to be able to recognize the truth of a contemporary mantra: identity is the fundamental currency in any technology transaction.

Everything must be covered: bots; service principals; IoT endpoints ; abandoned trial workloads; autonomous agents and agents that speak to other agents. Start by asking an overarching question: do these NHIs leverage a human identity when they perform tasks on behalf of that person, and is that appropriate? What to read next The next identity frontier: Verified workforce and the rise of agentic trust AI innovation meets a familiar identity
security reality Identity and attack paths - can you stop hackers getting
from A to B?

Then it is possible to drill into practical areas like guarding against credential misuse across agents, improving digital and identity hygiene by spotting risks relating to non-expiring tokens, and analyzing API access levels on a just-in-time basis.

ISPM (Identity Security Posture Management) is useful here because organizations need to have a handle on what they have, and must bring
identity constructs together. However, this is not a one and done discovery process so consider it as a CI/CD journey of continuous improvement.

In the AI era, holistic technology inventory can't be CMDB-based but must be dynamic and based on CI/CD pipeline control frameworks that let us
dynamically view and slice and dice data and assets by controlling who is using what and where. Think of it as an opportunity Its a complex task and we are all busy. But we need to pause and think about how this inflection point can be parlayed into a positive. This is an opportunity for the security and identity teams to start asking ourselves about the constructs we can apply to nonhuman identities.

They should be asking what needs to be added to legacy IAM frameworks to be successful. And usually the answer will be to replace them with systems that are coded for the current age, not the previous one.

By providing these new controls the identity team will become respected and sought out. Identity leaders will gain kudos by their ability to attribute risk ratings based on behavioral analytics and business function.

By demonstrating insights into where data sits, where it moves to and from, and how identity supports that, identity leaders can deliver qualitative and quantitative process analysis. In some cases of outperforming best practices and execution, they will even help to refine business process re-engineering through a platform that informs prioritization and budget management. We've featured the best IT management tool. This article was produced as part of TechRadar Pro Perspectives , our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit



======================================================================
Link to news story: https://www.techradar.com/pro/cios-must-rethink-identity-now-people-are-being- outnumbered-by-nonhuman-entities


--- Mystic BBS v1.12 A49 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)