Research: Human and Non-Human Identity Growth

Summary

The number of identities in an enterprise grows faster than the processes built to govern them, because most of the growth happens outside the workforce. Service accounts, API keys, tokens, application registrations, pipeline credentials and workload identities are created wherever software is built and run, by many teams, for many reasons. Few of them have an owner, an expiry or a place in an inventory.

Scope and method

This is a desk analysis. It draws on primary, attributable sources: Microsoft’s published account of a nation-state intrusion that used a legacy test tenant account and a legacy OAuth application; Mandiant’s analysis of a data theft campaign that relied on long-lived stolen credentials; and the OWASP Non-Human Identities Top 10. No survey or proprietary dataset was collected.

Published ratios of non-human to human identities circulate widely. This report does not repeat or rely on them. None was validated against a documented dataset for this analysis, and the term identity is defined differently from one source to the next. Statements taken from sources are labeled as documented, the author’s reading as interpretation, and anything that needs an organization’s own data as a hypothesis.

Findings

1. Growth follows how software is built and connected

OWASP’s list of non-human identity risks is organized around service accounts, API keys, tokens, secrets and third-party integrations. Each of those is a thing that software creates when it needs to talk to other software.

Interpretation: every new integration, pipeline, workload and automation can create at least one identity with at least one credential. Identity count therefore tracks engineering activity more closely than it tracks headcount. A new class is arriving as well: AI agents acting with delegated access, which belong in the same governance model from the start. That subject is covered in AI Identity and Access Governance.

2. Human and non-human identities do not share a lifecycle

A leaver triggers a disable action for a human identity because employment is the lifecycle. OWASP places improper offboarding first on its list of non-human identity risks, which points to the missing equivalent: an application, integration or service account has no leaver event.

Interpretation: the asymmetry is the core governance problem. Human identity governance has a trigger, an owner and a deadline. For most non-human identities, retirement depends on someone remembering.

3. Identities outlive their purpose and keep their access

Microsoft reported that the actor in its intrusion compromised a legacy test OAuth application that had elevated access to the corporate environment, and used it to grant a mailbox-access role to malicious applications it created. The application was built for testing and was still capable of acting on the production environment.

Interpretation: this is what unmanaged growth looks like at the level of a single identity. It was created for a reason, the reason expired, the identity stayed, and its privilege stayed with it.

4. Credentials multiply with identities, and exposure lasts

Mandiant found that credentials taken by infostealer malware were in some cases still valid years after theft because they had not been rotated. OWASP lists secret leakage, long-lived secrets and reuse of non-human identities across contexts among its ten risks.

Interpretation: each additional identity adds a credential, and each credential adds a way for exposure to turn into access. If rotation does not scale with creation, the stock of valid but unwatched credentials grows with the identity population.

5. The boundary between human and non-human blurs

OWASP lists human use of non-human identities as a risk in its own right. When a person logs in with a service account, activity logs lose the link between action and individual.

Interpretation: classification errors compound the growth problem. An inventory that cannot tell a person from a process cannot apply the right controls to either.

Why the risk may grow faster than the count

Hypothesis, not finding: risk grows faster than the number of identities when growth is unmanaged, because each identity adds permissions and relationships as well as a credential. The meaningful exposure is the graph of what can act on what, not the headcount of identities. This hypothesis is consistent with the cases reviewed, but it cannot be confirmed without estate data: permission assignments, consent records and credential ages measured over time.

Measuring growth without borrowed numbers

Start by agreeing identity classes. Without agreed classes, counts mean different things to different teams.

Then keep a ledger. The measures below are defined so that each organization can compute them from its own systems. Read them as proportions and trends against your own baseline, not against other companies.

The data sits in the identity provider, cloud IAM, SaaS administration consoles, secrets managers, code repositories and pipeline systems. Collecting it will be the first finding: most organizations discover the inventory gap before they discover any specific weak identity.

Limitations

• No measured growth rates. The report establishes mechanisms from documented cases. It does not say how fast identity populations are growing in any sector or region.

• Selective evidence. Disclosed incidents skew toward large organizations that publish detail, and each account reflects its author’s vantage point.

• Consensus, not frequency. The OWASP list represents community judgment of risk, not measured prevalence.

• Definitions vary. Whether an API key, a token or an application registration counts as an identity differs between tools and teams, so cross-source comparisons are unreliable.

• What would strengthen it. An organization’s own ledger, built over several periods with a stated population, collection method and classification, would convert the hypothesis above into a testable result.

Implications for security leaders

• Make ownership a condition of creation. No identity without an accountable owner and an expiry or review date.

• Instrument the creation points. Cloud consoles, pipelines, SaaS admin panels and agent platforms are where growth happens. Governance that starts at the inventory is already late.

• Fund non-human identity governance explicitly. Workforce identity programs are built around the joiner, mover, leaver cycle. Non-human identities need their own lifecycle design.

• Decide the classification rules first. Agree classes and definitions before collecting counts, or the numbers will not be comparable across teams or over time.

• Bring AI agents in early. Treat them as a distinct class with defined authority and accountable owners before deployment scales.

How to rank identity risk once the population is visible is covered in the companion report, Identity Risk in the Modern Enterprise.

Sources

Microsoft Security Blog, Midnight Blizzard: Guidance for responders on nation-state attack. microsoft.com

Google Cloud, Mandiant, UNC5537 Targets Snowflake Customer Instances for Data Theft and Extortion. cloud.google.com

OWASP, Non-Human Identities Top 10. owasp.org