Quick answer: Machine identities (NHI, Non-Human Identities) are the identities that non human entities (service accounts, API keys, tokens, bots and AI agents) use to access systems. With the spread of AI agents these identities have exploded and in most organizations they far outnumber human accounts. The problem is that these identities are usually over privileged, unmonitored and valid forever. Because AI agents act autonomously, a compromised machine identity creates a serious risk.

Why are machine identities a new risk?

Classic security focuses on human accounts: passwords, multi factor authentication, removing access from departing staff. But most system to system communication and automation is done not by humans but by machine identities. An API key, a service account or an AI agent often accesses more systems than a human.

AI agents changed this picture. An AI agent can make decisions on its own and access multiple systems, APIs and data. If this agent's identity is compromised or over privileged, the attacker takes over all of its access. And because the agent runs autonomously, abuse can continue unnoticed.

The difference between human and machine identity

Feature Human identity Machine identity (NHI)
Count Limited Very many, growing fast
Authentication Password, MFA Key, token, certificate
Lifetime For the duration of employment Usually indefinite, forgotten
Monitoring Relatively good Often weak
Privilege Role based Often overly broad

Protecting AI agent identities

  1. Inventory all machine identities (keys, tokens, service accounts, agents) so none stay in the shadows.
  2. Apply the least privilege principle so each agent has only the access it needs.
  3. Apply lifetime and rotation to identities, do not leave indefinite keys.
  4. Monitor the actions of AI agents and keep an audit trail.
  5. Do not leave keys and tokens exposed in code and configuration.
  6. Build a mechanism to quickly revoke an agent's access when it is compromised.

The KAOS and DSET approach

DSET audits organizations' machine identity and AI agent access surface: which keys, service accounts and agents exist, what privileges they have, and whether they are monitored. Our KAOS security engine reports exposed keys and over privileged access in code and infrastructure. We evaluate the over privilege and abuse risk of AI agents in an evidence based way. Our goal is to make shadow identities visible before an attacker does.

Related reading: LLM agent excessive agency and tool abuse, autonomous AI agent security, IAM identity and access management, PAM privileged access management, leaked API keys and secrets management, ITDR identity threat detection.

Frequently asked questions

What is a machine identity (NHI)? A machine identity is the identity that non human entities use to access systems: service accounts, API keys, tokens, certificates, bots and AI agents. In most organizations these identities far outnumber human accounts but are usually less monitored and have more privilege.

Why do AI agents amplify machine identity risk? Because AI agents act autonomously and can access multiple systems, APIs and data on their own. If an agent's identity is compromised or over privileged, the attacker takes over all its access, and because the agent runs autonomously the abuse may go unnoticed for a long time. That is why least privilege and monitoring must be applied to agent identities.

How do I protect machine identities? First inventory them all, because you cannot protect an identity you cannot see. Then come least privilege, lifetime and rotation, not leaving keys exposed, and action monitoring. One of the most important steps is being able to quickly revoke an identity's access when it is compromised.

Sources

To audit your machine identity and AI agent access surface, you can talk to our team at Ankara Hacettepe Technopark. Contact DSET.