error
Subscriptions are not available for this site while you are logged into your current account.
close
Skip to main content
Submit RFP

      Are your non-humans letting in hackers? How to secure your NHIs

      Non-human identities now vastly outnumber human ones inside every organisation. The problem is that they are also the fastest-growing, least-secured attack surface in the modern enterprise. Here's what you need to know to get ahead of the risk.

      What are NHIs?

      Non-human identities (NHIs) are the digital credentials that let machines interact with each other automatically. Think of them as an AI agent’s digital ID card. But unlike human digital IDs which are centrally managed through established HR processes, NHIs are created programmatically, often by developers or automated pipelines, at massive scale and with minimal oversight.

      Kalpana Iyer

      Director, Advisory

      KPMG in the UK

      While most companies keep tight control over their human digital IDs, non-human ones are often highly privileged, heavily fragmented and multiplying fast, which means traditional identity governance simply isn’t sufficient to secure them. Understanding what NHIs are, and how differently they behave, is the first step to bringing them under control.

      Kalpana Iyer, Director, T&D Cyber Id & Sec

      KPMG LLP

      Why cyber leaders worry about NHIs

      The big difference between human and non-human IDs is that NHIs don't support Multi-Factor Authentication (MFA), the security process that requires more than one method to confirm a user's identity. That means a single stolen credential can bypass the protections built for human users entirely, giving attackers a direct route into critical systems.

      The business consequences are significant and immediate: a compromised NHI can disrupt payments, halt customer-facing services, or break the integrations that connect essential operations.

      Regulators have taken notice too, with several high-profile breaches resulting in fines ranging from tens of millions to hundreds of millions of pounds. On top of the financial risks, organisations also face reputational damage, loss of customer trust and the operational cost of rebuilding systems after an incident.

      Five questions to ask your cyber leadership:

      • Do we have an NHI policy in place?
      • Do we have a full inventory of our NHIs?
      • Who is accountable for each NHI?
      • Are credentials vaulted and rotated?
      • How are we avoiding long-standing credentials?

      Your NHIs are proliferating

      Here are some of the more common places you’ll likely find insufficiently protected NHIs in your organisation:

      Service accounts:

      These non-interactive accounts running backend processes are often exempt from MFA processes.

      API keys and tokens

      With APIs authenticating services to each other, the risk of leaked credentials or over-permissioned access rises.

      RPA bots:

      These bots tend to imitate human logins, but with shared, rarely rotated credentials.

      Agentic AI agents:

      NHIs proliferate as agents autonomously chain actions across systems without human prompting.

      Measuring success in clear terms

      Experience working with leading UK companies to identify, inventory, protect and monitor NHIs suggests there are four metrics matter most: ownership mapping, which shows what percentage of NHIs are tied to a verified human or team owner; credential lifespan, which tracks the ratio of long-lived secrets against short-lived, ephemeral tokens; pipeline hygiene, measured by how quickly hardcoded secrets are detected and remediated in CI/CD pipelines; and cleanup rate, the number of dormant or orphaned NHIs decommissioned each quarter.

      Together, these give a clear, ongoing picture of maturity rather than a one-off snapshot.

      Setting and tracking the right KPIs is essential to knowing whether your NHI programme is actually working. Without clear metrics, organisations have no way to measure progress, prioritise remediation, or demonstrate improvement to the board or regulators.

      Harriet Burwood, Senior Manager, T&D Cyber Id & Sec

      KPMG LLP

      Four steps to protecting your NHIs

      1. Assess your NHI landscape to establish visibility and baseline risk.
      2. Design a governance framework that defines ownership and lifecycle controls.
      3. Implement secretless architecture and enforce least-privilege access.
      4. Monitor continuously, using ITDR to detect and respond to anomalies in real time.
      Download

      KPMG Cyber Security: Non-Human Identities (NHI) Management – From Risk to Resilience

      A KPMG guide to Non-Human Identity (NHI) Management, covering machine identities, service accounts, API keys, cloud workloads, AI agents, and automated systems.

      Download

      How KPMG can help

      KPMG turns NHI risk into a secure business enabler, combining technical delivery, vendor expertise and regulatory insight across the full NHI lifecycle.

      Our teams work end-to-end, from initial discovery and risk assessment through to governance design, secretless transformation and ongoing managed monitoring, to help organisations move from fragmented visibility to continuously governed, audit-ready NHI environments.

      Our deep experience across the leading NHI vendor platforms means we can help you choose and implement the right combination of tools for your environment, rather than a one-size-fits-all approach.

      Check out our cyber services website here or contact your trusted KPMG advisor to learn more.

      Our advisory insights

      Something went wrong

      Oops!! Something went wrong, please try again
      MTD

      Get in touch

      Discover why organisations across the UK trust KPMG to make the difference and how we can help you to do the same.

      Contact us