NHI governance for CISOs

The question you will be asked

Non-human identities have been a leading breach root cause since 2023, and the pattern in the major incidents is monotonous: a credential that should not have existed, or should not have had that scope, or should have expired. Snowflake, Okta, Salesloft/Drift, Codecov. Different attackers, same shape.

What follows in a board or regulator conversation is never "are you secure." It is show me. The distinguishing feature of CISOs who handle this well is that they have converted a qualitative worry into three quantities they can state without hedging.

Three numbers to hold

1. Inventory coverage. What proportion of your non-human identities are in a maintained inventory with a named owner? Not "we have a tool". What percentage, measured how, verified when. Most organisations discover their true count is several times their tracked count.
2. Credentials with unbounded lifetime. How many API keys, service account credentials, and tokens have no expiry? This is the single number most predictive of breach exposure and it is usually obtainable within days.
3. Time from revocation to inability to act. If you revoke a compromised credential right now, how long until it can no longer be used? If you have not measured this, you do not know it, and it is the number an incident will test.

All three are measurable without buying anything. That is deliberate: a CISO who can state them has a defensible position before any procurement decision.

What a defensible position actually looks like

It is not full coverage. Nobody has that. It is:

• A measured baseline with a date on it.
• A risk-ranked remediation order: production-reaching, unbounded-lifetime, unowned credentials first.
• Named accountability per identity class, not per tool.
• An explicit list of what you are not doing yet, and why. This is the part most CISOs omit and the part that most protects them. A documented, reasoned deferral is a governance decision. An undocumented gap is a finding.
• A tested revocation path with a recorded result.

Claims to avoid

• "We have full visibility." Almost never true, and the first thing an incident disproves. Say what percentage, measured how.
• "Our PAM covers this." PAM covers privileged accounts well. It does not cover SaaS-to-SaaS OAuth grants, CI/CD tokens, or agent credentials. See the vendor comparison for where each tool's coverage actually stops.
• "We're compliant with the NHI standard." There is no such standard. See the standards tracker.
• "Agents are just service accounts." Defensible for provisioning, indefensible for accountability. An agent acting on a human's behalf creates a delegation chain that a service account model cannot represent, and that is what an auditor will ask you to reconstruct.

First ninety days

1. Days 1 to 30: measure the three numbers. Do not procure. Do not restructure. Measure.
2. Days 31 to 60: eliminate the worst class. Unbounded-lifetime credentials reaching production. Assign owners to the top decile by blast radius.
3. Days 61 to 90: run a revocation drill and record the time. Write the deferral list. Take the baseline, the remediation order, and the deferral list to the board together.

Procurement decisions belong after this, not before. Buying a platform without an inventory or an ownership model produces a well-organised list of problems you are not structured to fix.

Frequently asked questions

What should a CISO report to the board about non-human identity?

Three measured numbers rather than a qualitative assurance: inventory coverage as a percentage with a measurement date, the count of credentials with unbounded lifetime, and the measured time from revocation to inability to act. Alongside those, a risk-ranked remediation order and an explicit documented list of what is not being addressed yet and why. A reasoned deferral is a governance decision; an undocumented gap is a finding.

Does our existing PAM solution cover non-human identities?

Partially. Privileged access management covers privileged service accounts well, particularly in regulated on-premise environments. It does not natively cover SaaS-to-SaaS OAuth grants, CI/CD pipeline tokens, cloud workload identities, or AI agent credentials. Assuming PAM coverage is one of the most common gaps found in assessments.

How much of an NHI programme is tooling?

Roughly a quarter, in our experience. The majority of the effort is organisational: attributing an accountable owner to every non-human identity, deciding what each identity class should be permitted to do, and being able to evidence both. No platform performs that work for you, which is why buying before measuring tends to stall programmes.

Should AI agents be treated differently from service accounts?

For provisioning, they can be treated similarly: both need a distinct, attested, short-lived credential. For accountability they cannot. An agent acting on a human's behalf creates a delegation chain, and if your logs record only the service principal you cannot reconstruct who authorised an action. That reconstruction is what auditors and regulators are beginning to request.