Key Takeaways from the 2024 ESG Report on Non-Human Identity (NHI) Management

For years, Identity and Access Management (IAM) has centered on human identities, built on the assumption that people are the weakest link in the cybersecurity chain. However, the digital landscape has shifted dramatically. Today, the average person interacts with 30 to 50 applications daily, while behind the scenes, machines, applications, cloud services and automated processes are powering nearly every business function. As a result, the number of non-human identities (NHIs) has far exceeded that of human identities.

While managing human identities is still important, the growing volume and complexity of non-human identities make their management even more critical. Ensuring they are properly secured and monitored is now a top priority for organizations looking to protect their systems and data in an increasingly automated world.

Non-human identity management involves managing a diverse range of device and workload identities, including digital certificates, SSH keys and certificates, API cloud keys, service accounts, and other automated systems. As these identities continue to proliferate deeply into digital ecosystems, there is a greater need to gain a better understanding of the NHI space. This is vital for proactively addressing challenges, improving identity lifecycle management, and reducing operational and security risks.

In our newly released report – Securing Non-Human Identities: Insights for an Effective Cybersecurity Program – we explore this rapidly evolving space. The report draws insights from a survey of over 360 IT, cybersecurity, DevOps, platform, and cybersecurity engineering professionals across North America (US and Canada).

Conducted in partnership with the Enterprise Strategy Group (ESG), the report assesses the rising volume of NHIs, alongside the challenges and risks they present. It turns out that managing NHIs in modern IT environments has become far more complex than it used to be, signaling that it’s time to rethink the old-school way of NHI management.

Here Are Some Key Findings from the ESG Survey Report:

1. Managing Non-Human Identities is A Growing Challenge

Non-human identities are increasing exponentially, far outpacing the growth of human identities. The ESG survey discovered that organizations, on average, have 20X more non-human identities than human identities. This trend is expected to continue, with 52% of organizations predicting an additional 20% increase in NHIs they manage over the next year. The explosive growth in NHIs is not startling, given the rising adoption of cloud initiatives, containerization, IoT devices, AI, and application modernization initiatives that typically have many moving parts and, therefore, require a large number of identities to secure.

2. Inadequate NHI Security is Creating Significant Security Risks

As the number of non-human identities (NHIs) increases, security challenges grow proportionately. Managing thousands and thousands of NHIs across a diverse IT landscape has become highly complex, particularly for those organizations relying on outdated or manual management practices, such as spreadsheets and home-grown tools. Without proper oversight and automation, many NHIs go unmonitored and poorly secured, creating weak links for attackers to exploit.

According to the survey, organizations believe more than one in five of their non-human identities are insufficiently secured.

This gap in security increases the risk of operational disruptions, data breaches, and compliance violations.

3. Avoiding Operational Interruptions and Visibility Are Leading Concerns

The rising number of non-human identities coupled with the reliance on manual management practices has led to serious operational and security risks. Survey respondents highlighted several key concerns.

• The most pressing concern is the risk of operational interruptions caused by expired digital certificates, which are often overlooked in manual workflows. If a certificate associated with a critical device, application, workload expires, it leads to system outages, service disruptions, and a loss of customer trust, directly impacting operations and revenue.
• The second major concern is the lack of visibility into the behavior of non-human identities at runtime. Without real-time insights into how these identities interact with other systems and data, enforcing least-privilege policies becomes difficult, increasing the risk of security blind spots and slowing down threat detection and response.
• The third concern is the limited visibility into the attack surface created by NHIs. As NHIs interact across multiple platforms and environments, understanding the full scope of their access and permissions becomes complex. Without clear visibility into their attack surface, organizations struggle to identify vulnerabilities and properly secure these identities, leaving them exposed to expiration and potential exploitation.
• The fourth concern is compliance risk. As regulations around data protection and identity management become more stringent, the inability to effectively manage and secure NHIs can result in costly compliance violations.
• The fifth concern is the misalignment between identity-first security approaches and zero-trust strategies. While both frameworks aim to secure access by verifying identities and limiting trust within the network, the lack of robust NHI management prevents these strategies from being effectively implemented, undermining both security models.

4. Multiple Non-Human Identity Compromise Events Reported

The report reveals that two-thirds of enterprises have experienced a successful cyberattack resulting from compromised non-human identities. Alarmingly, one-quarter of these enterprises encountered multiple attacks. Enterprises also reported experiencing an average of 2.7 non-human identity compromises in the past 12 months, underscoring the growing vulnerability associated with the mismanagement and insufficient security of NHIs.

While there are several factors leading to these compromises, some of the most commonly cited are:

• Weak or deprecated encryption algorithms (29%)
• Exposed keys or secrets stored in files, spreadsheets, etc. (29%)
• Expired certificates (23%)
• Unknown revoked certificates (21%)
• CA compromise (18%)

The impacts of these NHI compromises are far-reaching, with businesses suffering a range of operational, security, and financial consequences.

The most commonly reported business impacts include:

• Increased cybersecurity budget (27%)
• Lost or stolen customer data (25%)
• Additional cybersecurity technologies and services investment (24%)
• Damage to brand reputation (23%)
• Request for regular cybersecurity updates from the board of directors (22%)

5. NHI Compromises Are Getting Board of Directors’ Attention

As non-human identities are fundamental to everyday business operations, any compromise of these identities poses a significant risk to the continuity, security, and reputation of the organization. The potential for disruption to core business processes, whether through service outages or security breaches, has elevated NHI compromises as a top concern, drawing the attention of corporate leadership, including boards of directors.

According to the ESG survey, 57% of non-human identity compromises definitively got board-level attention, while 37% of respondents indicated their organization’s board may have delved into the details of the incident.

6. Non-human Identity Security Spending Is Expected to Increase

To streamline non-human identity management and mitigate the evolving risks associated with them, organizations are preparing to increase their investments in NHI security. The ESG survey reveals that a notable 83% of organizations expect to spend relatively more on NHI security, with nearly one in five expecting to spend significantly more.

Key areas expected to receive the most attention over the next 12 months include:

• Identity threat detection and response
• Non-human identity visibility, monitoring, and remediation
• Customer identity and access management
• Cloud infrastructure entitlement management
• Certificate lifecycle management

With the growing dependency on NHIs to facilitate automated processes and machine-to-machine communications in cloud, IoT, and AI-driven environments, the need for effective NHI management has never been more urgent. The sheer complexity and scale of these identities have outgrown traditional identity management processes. Frequent incidents of NHI compromises make one thing clear – manual processes will no longer do. They must give way for advanced tools and strategies that are flexible and scalable.

To learn more about non-human identity management and security and dive deeper into all the key findings, read our full report.