Identity security conversations often arrive at the same unfortunate scenario: a stolen token and breach only discovered once major damage is done. Experts Rob Kraczek, global strategist at One Identity, and Chris Ray, field CTO of security and risk at GigaOm, recently unpacked why 3 a.m. token theft has become less exception, more routine — among other things.
Their conversation at large, fueled by Chris's recent non-human identity (NHI) research, covered why NHIs win the title of largest blind spot in enterprise security.
The "3 a.m. scenario" is as real as it gets
Chris opened by admitting he almost undersold its risk in his own writing. But there’s no mistaking it: Credential and token theft is now the principal way attackers get in, a pattern confirmed by both Verizon's Data Breach Investigations Report (DBIR) and Mandiant's M-Trends reports.
Ratios aren’t the point
Chances are high you’ve come across a wide range of NHI to human ratios. The webinar explored as much, finding variation across industries and regions.
17:1. 45:1. A whopping 144:1. The numbers start to paint the picture, but they don’t complete it. Rob noted how the ratio is a mere drop in the bucket next to the kill chain: No matter the headcount, an attacker’s path — token leaks, chained credentials, cloned sessions — is a constant.
And that’s where understanding which identities carry the most privilege becomes pivotal. A small pool of over-permissioned, poorly scoped accounts creates far more exposure than the total headcount of NHIs ever will, and agentic AI only speeds up how fast those risky identities can spread, undetected.
A taxonomy worth sitting with
The pair laid out a useful mental map of the many types of NHIs: service accounts, API tokens, SSH keys, RPA bots, workload identities, AI agents. Chris cautioned though that this simply illustrates the problem visually, not intended as a literal blueprint for how your security program should be structured. Importantly, each category tends to sit with a different team, under different management.
But uniquely, AI agents (the fastest growing of the bunch) sit with no one. While other NHIs carry out a defined task, AI agents make dynamic decisions about what to access next — something static permission models can’t ever hope to accommodate.
Most security programs are airtight for people, just not machines
A central thread of the discussion was that most enterprises have reached a genuinely mature state for managing human identities, while their NHI governance is stuck in a fragmented stage.
That’s not for a lack of effort either. The gap appears with identity governance and administration (IGA) and privileged access management (PAM) tools designed around human patterns, with many solutions not yet built for NHI visibility.
Watch for the step most programs skip
Discovery and inventory of your NHIs has to come first, and the duo agreed nothing else works until someone is made accountable for them. Without a named owner, no one’s there to make the call on credential rotation or access reviews.
Put the automation cart before the ownership horse, Chris warned, and you end up just scaling a problem you haven't solved yet.
Is AI up to the task?
Asked directly whether AI could finally deliver on the Zero Trust model, Chris was skeptical of the hype. His view: AI is more likely to surface gaps that have existed in identity programs for years than to quietly fix them on its own.
That same skepticism shaped how both speakers described their companies’ use of the tech. Rob explained how One Identity is taking a "bring your own AI model" approach rather than locking customers into a single agentic AI/LLM model, while building AI into slower processes like role modeling and onboarding. Chris said GigaOm leans on AI mainly to catch human error in its research rather than to generate writing outright — and both reflected on how this distinction can get lost as vendors rushed to add chatbot-style interfaces to their products.
The takeaway
Rob and Chris left listeners with a fitting reminder that identity security rarely stays contained to one vendor, any one identity type, anymore. It depends on mapping out all the pieces before deciding to change them.
Rob said it well: “Chris and I are in agreement that you look at the big picture and then whittle it down.”
Watch their complete discussion here.
