Veeam: Non-Human Identities: What They Are & How to Govern Them

Name: Veeam: Non-Human Identities: What They Are & How to Govern Them
Uploaded: 2026-10-04T11:57:46-04:00
Duration: 1 min 32 s
Description: Non-human identities outnumber humans by more than 80 to 1, and they hold real access with almost no oversight. Learn what they are and how to govern them. #nonhumanidentity #NHI #machinegovernance #dataprotection #veeam Check out our blog for the full...

Veeam

10/04/2026

0 (0%)

Report Like Favorite

TL;DR

Non-human identities — service accounts, bots, AI agents, and workload identities — now outnumber human users by more than 80 to 1 in the average enterprise.
Machine identity counts have grown fivefold in four years, from roughly 50,000 in 2021 to 250,000 in 2025, outpacing most governance programs.
The primary risk is ownership, not technology: orphaned service accounts with live credentials and no assigned owner are prime targets for attackers.

Summary

This short explainer from Veeam introduces the concept of non-human identities (NHIs) — digital identities used by software, services, workloads, devices, bots, and AI agents rather than by people. In the average enterprise, NHIs now outnumber human users by more than 80 to 1, a ratio that has grown dramatically as machine identity counts jumped from roughly 50,000 in 2021 to 250,000 in 2025. These identities authenticate via API keys, tokens, certificates, secrets, and passwords, yet they are consistently among the least governed assets in any organization. The core risk is not technical complexity but ownership: most teams cannot accurately report how many NHIs they have, what systems those identities can access, or when they were last reviewed. Orphaned service accounts with live credentials and no assigned owner represent an ideal, often unmonitored attack surface. Veeam directs viewers to a companion blog post for a full governance guide, positioning the content as an entry point into a broader NHI security conversation.

Chapters

0:00 - The Identity Gap
0:06 - What Non-Human Identities Are
0:53 - Scale and Growth Since 2021
1:10 - The Ownership Problem

Key Quotes

0:00 "Most identity programs were built for humans, but your environment isn't mostly human anymore."
0:21 "These identities can outnumber human users by more than 80 to 1."
1:10 "Because the hardest part isn't technical, it's ownership."

FAQ

What counts as a non-human identity?

Non-human identities include service accounts, workload identities, robotic process automation bots, continuous integration pipelines, and AI agents. They authenticate using API keys, tokens, certificates, secrets, and passwords rather than human credentials.

Why are non-human identities a security risk?

They are often the least governed identities in an enterprise. Most teams cannot report how many they have, what those identities can access, or when they were last reviewed. Orphaned accounts with live credentials and no owner are particularly attractive targets for attackers.

Categories:

» Cybersecurity » Zero Trust
» Data Protection

Tags:

Show more Show less

TL;DR

Summary

Chapters

Key Quotes

FAQ

Ensuring Compliance Through Audit Evidence: From CJIS to FERPA

Risk in Real Time Demo Series: Virtual Patching: Protection at the Speed of Exploitation

Harnessing Data Governance for AI with Cyera and Snowflake