How do you secure non-human identities for AI agents in an enterprise stack?

Why non-human identity became the urgent problem

By mid-2025, the conversation around AI agents inside enterprises stopped being about model quality and turned toward identity. CrowdStrike's 2026 earnings commentary specifically called out the "expanding enterprise AI attack surface," and several vendors — Silverfort, Teleport, JumpCloud, Netwrix, and Palo Alto Networks' Idira — moved non-human identity (NHI) into their core product roadmaps within a 12-month window. The reason is mechanical: an agent that calls APIs, queries data warehouses, drafts legal contracts, and posts to CRM is no different from a contractor who has been issued a corporate laptop, a SAML credential, and four service accounts. The only practical difference is that the agent acts thousands of times per hour, often autonomously, and almost always inherits more privilege than the engineer who wired it up.

Also worth reading: How Do Companies Build a Reliable Enterprise AI ROI Framework in 2026? · Which Enterprise AI Pilot Metrics Actually Prove ROI in 2026? · How Should an AI Pilot ROI Framework Measure Value Before a 2026 Enterprise Rollout?

The BankInfoSecurity webinar "Accelerating Agentic AI: Securing Autonomous Workflows and Non-Human Identities" framed the issue bluntly: traditional identity governance was designed for hiring and offboarding humans, with a quarterly access-review cadence. Agents are spun up, duplicated, retired, and mutated by code rather than HR, which means the human-shaped review process misses 60-80% of the actual identities in production according to industry surveys cited by SC Media and CIO.com in late 2025.

What a non-human identity actually is

An NHI is any credentialed principal that is not a human user. In practice that bucket covers four families: service accounts, API keys, machine credentials (certificates, mTLS identities), and agent identities — the newest category, where the principal is an LLM-driven software process that calls tools and takes actions on a human's behalf. The Idira platform from Palo Alto Networks and the Silverfort AI Agent Security product, both released in 2025, both treat agent identities as a first-class subtype rather than as service accounts with a fancier name.

Teleport's approach is instructive: instead of relying on long-lived API keys, Teleport issues short-lived cryptographic identities through identity-based cryptography. An agent authenticates as itself for a bounded task, receives a certificate valid for minutes rather than months, and cannot reuse that credential outside the original workload. This pattern is increasingly the reference design that MSPs in Managed Services Journal recommend to mid-market customers, because it removes the standing-secret failure mode that produced several large breaches in 2024.

The building blocks of a practical NHI program

A working agent identity stack typically rests on five components. First, a directory of record — Entra ID, JumpCloud, Okta, or in Pomerium's case a gateway that sits in front of every downstream service — that holds the agent principal alongside human users. Second, a credential issuance layer that prefers short-lived certificates over static tokens. Third, a policy engine that decides which agents can call which tools, often expressed as OAuth scopes plus an ABAC layer. Fourth, observability: every agent action needs a tamper-evident log because the agent's reasoning is not the same as an audit trail. Fifth, a lifecycle hook that ties an agent's identity to its code commit, its owner, and an expiration date.

Netwrix's July 2025 release extended Entra ID monitoring to cover AI agent identities specifically — surfacing orphaned service principals, dormant OAuth grants, and tokens that outlive the workload that requested them. This is the kind of tooling that turns NHI from a theoretical risk into a manageable inventory, and several a16z "Big Ideas 2026" writers flagged it as the missing layer that previously kept mid-market CISOs from even attempting the problem.

How Pomerium, Silverfort, Teleport, and Idira compare

The vendor landscape for agent identity is moving fast, but the four most cited platforms in 2025-2026 differ in approach. The table below summarizes how they position themselves based on the public materials, release notes, and analyst write-ups from BankInfoSecurity, SC Media, Redmondmag, and the vendors' own documentation.

The practical takeaway is that none of these tools is sufficient on its own. Pomerium and Teleport prevent problems by removing standing credentials; Silverfort and Idira detect problems by correlating behavior across the identity stack. Mature programs typically deploy one from each column.

The most common mistakes teams make

The pattern that recurs across breach postmortems and Solutions Review's 2026 cybersecurity predictions is that engineers bolt an agent onto an API key generated by a personal account. That key inherits the engineer's full permissions, never rotates, and shows up in no access review. A second failure mode is treating agent identity as a sub-problem of secrets management: storing the agent credential in HashiCorp Vault is necessary but not sufficient, because Vault does not know whether the agent behind the credential is supposed to exist.

A third mistake is scope creep. Many teams grant an agent the union of every permission the human owner has, on the assumption that "it might need this later." The Idira documentation and the CIO.com analysis both flag this as the single largest source of agent-driven incidents in 2025. The corrective pattern is to model the agent's blast radius the same way you would model a contractor's: a specific scope, a specific data set, a specific expiration, and a specific owner who is on the hook if the agent misbehaves.

Practical first steps for a small operator network

For a private deal-flow network like The Mercer Club — where founders, operators, and a growing number of AI copilots all touch the same CRM, document vault, and chat surface — the realistic first 90 days look like this. Inventory every API key, OAuth client, and service principal in production and assign an owner to each. Move every long-lived secret behind short-lived credential issuance, either through Teleport-style certificates or Pomerium-style session tokens. Connect the directory of record to an observability tool — Netwrix for Entra ID shops, Idira for mixed estates — and turn on alerts for tokens older than 30 days, tokens without an owner tag, and tokens whose last use predates the agent's deployment date.

Then write an agent identity policy that defines who can spawn an agent, what scopes an agent can request, and how the agent's life cycle maps to the underlying code repository. The Pomerium Show HN post and the BankInfoSecurity webinar both emphasize that the policy does not need to be long — a one-page document that names a human accountable for each agent principal is enough to cut the orphaned-credential problem by half.

When the cost of doing nothing shows up

The financial calculus is straightforward but rarely written down. An orphaned agent credential that exfiltrates a deal pipeline costs a private network far more than the same credential would cost a public SaaS, because the relationship capital is concentrated and irreplaceable. CrowdStrike's threat data, cited in Security Today, suggests that identity-driven incidents now account for roughly 80% of enterprise breaches where an attacker moves laterally, and AI agents multiply the number of identities that an attacker can compromise by an order of magnitude.

The other cost is regulatory. The EU's data-transfer framework, the US state-level privacy laws active by 2026, and the emerging AI accountability rules in California and Colorado all assume that data access is attributable to an identified principal. When an agent acts on behalf of a founder and the action is not attributable to either the founder or the agent, the resulting record is legally incomplete. That gap becomes a problem the first time a deal dispute, an audit, or a regulatory inquiry asks "who saw this and why?"

How to phase the work over 2026

Three horizons map to the calendar. In the first 60 days, do discovery: every agent, every token, every owner. In the next 90 days, replace static secrets with short-lived credentials for at least the top-quartile of high-risk agents — those touching customer data, financial data, or deal terms. In the third quarter, add behavioral monitoring: alerts on agents that access resources outside their declared scope, that operate at unusual hours, or that are invoked from geographies the human owner does not normally operate in. By Q4 the program should be producing a quarterly NHI review that looks structurally similar to a human access review, which is the convergence point the industry seems to be heading toward.

A useful sanity check at each phase is whether you can answer four questions for every active agent: who owns it, what can it do, when was it last used, and what happens if it is compromised. If any of those four questions returns a blank answer for more than one agent in production, the program is not finished.