Download Publication
Who it's for:
- CISOs and Security Leaders
- Identity and Access Management Architects
- Cloud Security Architects
- SecOps Teams
- Platform and DevOps Engineers
- AI and Machine Learning Platform Owners
The State of Non-Human Identity and AI Security
Release Date: 01/26/2026
Based on a comprehensive survey of IT and security professionals, this report explores how rapid AI adoption amplifies long-standing Identity and Access Management (IAM) challenges. It reveals that AI does not introduce an entirely new identity paradigm. Instead, AI magnifies existing non-human identity (NHI) risks related to governance, visibility, ownership, and credential lifecycle management.
Most organizations still manage AI identities using legacy IAM tools and manual processes. But these resources were never designed for autonomous, high-velocity systems. As AI-driven workloads accelerate identity creation, organizations struggle with credential sprawl, unclear ownership, inconsistent automation, and slow remediation timelines.
The findings uncover four critical areas of concern:
- AI identities compounding traditional non-human identity security risks
- Persistent governance and ownership gaps
- The friction between AI speed and legacy IAM infrastructure
- Token sprawl caused by inadequate rotation and revocation practices
Together, these issues expand the operational attack surface and increase the blast radius of identity-related incidents.
This research provides a data-driven view into how organizations are currently managing AI-era identities. It shows why visibility, automation, and accountability are essential to securing AI at scale. Finally, it serves as a benchmark for identity maturity and a call to modernize IAM.
Key Findings:
- Organizations largely view AI identities through the same lens as traditional NHIs. When asked what constitutes an AI identity, most respondents selected service accounts, API keys or tokens, and chatbots.
- Governance remains one of the weakest links in organizations’ AI identity programs. Less than ¼ of organizations reported having documented and formally adopted policies for creating or removing AI identities.
- The limitations of legacy IAM systems often constrain AI opportunities. Only 12% of organizations reported being highly confident in their ability to prevent attacks via NHIs. Even fewer expressed high confidence that their legacy IAM solutions can effectively manage AI and NHI security risks.
- More than 16% of organizations said they do not track the creation of new AI-related identities. This leaves a growing subset of tokens and service accounts outside formal inventory.
Download this Resource
Share
Related resources
.jpeg)
Interested in helping develop research with CSA?
Related Certificates & Training
.png){kind=logo}
Learn the core concepts, best practices and recommendation for securing an organization on the cloud regardless of the provider or platform. Covering all 14 domains from the CSA Security Guidance v4, recommendations from ENISA, and the Cloud Controls Matrix, you will come away understanding how to leverage information from CSA's vendor-neutral research to keep data secure on the cloud.
Learn more
Learn more
