Non-human identities: the blind spot of your access reviews

For ten years, security programs have treated identity as a matter of people: passwords, MFA, quarterly access reviews, employee departures. Meanwhile, the population of identities that are not people has exploded, and it is now the way attackers most often get in.

What the 2026 reports say

SpyCloud's 2026 Identity Threat Report, released on September 9, 2026, puts compromised non-human identities at the top of the ways into the enterprise: they are the primary entry point in 31% of the incidents analyzed, nearly twice phishing and social engineering at 17%. Palo Alto Networks' Unit 42 2026 incident response report describes the same shift: identities, SaaS platforms, cloud entitlements and automation frameworks have become attackers' preferred paths as organizations adopt AI at scale.

The Cloud Security Alliance, in its white paper on the non-human identity governance vacuum, names the cause: these identities are created by development and operations teams, outside the HR processes that trigger reviews, and AI agents add a category that makes decisions and changes execution paths in ways access reviews were never designed to catch. Darktrace, in its mid-2026 update, sums up the trend in one line: trust has become the new attack surface.

Why your access reviews miss them

A classic access review starts from a list of people and asks a manager to confirm what each can do. Three things make it miss technical identities.

Nobody owns them. A service account created for an integration in 2023 belongs to a finished project, a developer who left, or "the team". When the owner is unknown, the reviewer confirms the access out of caution.

The cost of error is asymmetric. Removing a person's needed access costs a support ticket. Removing a token a nightly job depends on costs a production incident. Reviewers know it and let it through.

The rights are invisible in the review tool. An application principal with a Directory.ReadWrite.All scope, an access key attached to an administrator policy, a personal token with no expiry: these rights do not show up as "administrator" in a review table designed for human roles.

The result is measurable in almost every assessment we run: the most powerful identities in the estate are the ones that were never reviewed.

What we think at Sentrix

This is not a tooling problem; it is an inventory and ownership problem. On the exposure map we use to reason about continuous threat exposure management, the Identity domain holds as many non-human identities as people accounts, and they must be treated as assets: discovered, assigned, dated, retired.

Concretely, in order:

1. Inventory from the sources, not from spreadsheets: application principals and secrets in Entra ID, IAM users and access keys in AWS, service accounts in Google Workspace, personal tokens and repository secrets in GitHub and GitLab, API tokens of the critical SaaS tools.
2. Assign a named owner to every identity, with an expiry date. An identity without an owner after thirty days is disabled, not deleted: if nothing breaks in fourteen days, it is deleted.
3. Reduce scopes: replace broad rights with the minimum scope, separate read from write, one identity per use rather than a shared token.
4. Rotate and expire: automatic rotation where the platform allows it, mandatory expiry on anything created by hand.
5. Treat AI agents as first-class identities: every agent has an owner, an explicit tool scope, an action log, and its own review.
6. Put the review of non-human identities in the same cycle as the review of people, with the same evidence kept for the auditor.

This program needs no new platform to start. It needs a list, names and dates. It is also, for ISO 27001 (controls 5.16 to 5.18 and 8.2) and for SOC 2 (CC6 criteria), exactly what the auditor will ask to see.

The next step

The reports cited converge on one point: declared visibility far exceeds actual monitoring. Before investing in a tool, measure the gap at home: how many non-human identities you have, how many have an owner, how many were used in the last ninety days. The three numbers fit on one line, and they say what matters.