In 2026, the biggest cybersecurity threat to businesses is not always a hacker exploiting a technical vulnerability. It is an organisation that has lost track of who (or what) has access in the first place.
As companies accelerate cloud migration, automate workflows and deploy AI agents across operations, non-human identities (NHIs) such as APIs, service accounts, machine workloads and autonomous agents are now outnumbering employees in many digital environments. That shift is quietly rewriting the rules of cybersecurity practices.
“In environments dominated by non-human access, identity security shifts from managing user accounts to governing access based on purpose, behaviour and lifecycle,” said Darren Guccione, CEO and co-founder of Keeper Security, in an email interview with e27.
Instead of focusing solely on employee credentials, businesses now have to secure a growing population of machine identities that authenticate continuously, operate silently, and often remain active long after they are needed.
Traditional identity and access management (IAM) systems were designed for humans: people who log in, reset passwords and eventually leave the organisation. But NHIs behave differently, and many are created automatically.
According to Guccione, most organisations lose visibility at the point of creation. He explained that NHIs are frequently spun up through CI/CD pipelines, cloud orchestration platforms, SaaS integrations, and AI agents — often without passing through central IAM frameworks.
This means security teams may not even know how many service accounts or API keys exist, who owns them, or what level of privilege they hold. That blind spot becomes a direct entry point for attackers.
Also Read: SBI bets on Singapore to build Asia’s digital asset corridor
The hidden risk: NHIs do not get offboarded
Another major weakness in cybersecurity practices is that machine identities rarely go through proper lifecycle management.
“Unlike employees, NHIs are not typically offboarded,” Guccione said. Tokens, service accounts and API keys often persist even after a project ends, infrastructure changes or a tool is retired. This creates, he says, “a growing population of orphaned but still-privileged identities,” particularly in APAC enterprises undergoing rapid cloud migration.
From a cyber risk perspective, these orphaned identities are dangerous because attackers do not need to break in. They simply need to find the credentials that were never revoked. This means, in 2026, the most damaging breaches may not trigger obvious red flags. Guccione noted that the stealthiest NHI-related threats are those that “abuse legitimate access rather than exploiting vulnerabilities.”
One example is attackers hijacking CI/CD service accounts to tamper with build pipelines or inject malicious dependencies. Since these actions resemble routine development activity, they often bypass security alerts. Another tactic involves over-privileged cloud service accounts being used for slow, deliberate lateral movement.
“Attackers deliberately minimise observable indicators,” Guccione said, adding that they often access metadata services, storage or control planes gradually over weeks or months.
Because authentication succeeds legitimately, many cybersecurity tools fail to detect the intrusion. And long-lived API keys remain a major problem, particularly in SaaS-heavy environments common across APAC. Once compromised, they act as “durable backdoors.”
Also Read: In Southeast Asia, cybersecurity is booming but funding is not
Best cybersecurity practices to adopt in 2026
To protect against these evolving risks, organisations must modernise cybersecurity practices with a strong identity-first foundation. Guccione outlined three capabilities that matter most.
First is continuous discovery and classification of NHIs across cloud, DevOps, and SaaS environments. This should be supported by enterprise-grade identity governance and Privileged Access Management (PAM) to ensure a complete inventory of service accounts, machine credentials, and API keys, with clear ownership.
Second is behavioural monitoring. “Traditional access reviews show who has access, rather than how that access is explicitly used,” he said. Businesses need identity-centric analytics that establish a baseline of normal machine activity, enabling detection of unusual access paths, abnormal data transfers, or suspicious privilege escalation.
Third is automated enforcement. Modern secrets management and privileged access platforms automatically rotate credentials, reduce privileges, or revoke access once risk thresholds are crossed. In cloud-native environments, this can include isolating workloads or invalidating credentials in real time.
In short: detection and response must move at machine speed.
Across APAC, Guccione sees a major divide between regulated industries and fast-scaling sectors. However, he stressed that the gap is not awareness; it is execution.
Finance, telecoms, and critical infrastructure players generally have governance frameworks in place, but these are often “human-centric and slow to adapt” to cloud-native and AI-driven environments.
Also Read: In Southeast Asia, cybersecurity is booming but funding is not
Meanwhile, fast-scaling industries such as SaaS, e-commerce, and logistics excel in automation but often lack formal identity governance. Speed-to-market pressures lead to excessive privileges, shared credentials, and weak lifecycle controls.
For fast-moving companies, Guccione said “good enough” cybersecurity practices start with basic hygiene: centralised secrets management, eliminating hard-coded credentials, and assigning ownership to all machine identities.
For regulated sectors, “good enough” must go beyond compliance reporting into continuous monitoring that can detect misuse, not just satisfy audits.
A 2026 cybersecurity playbook for business leaders
For APAC executives building their cybersecurity roadmap, Guccione recommended five key priorities, starting with assuming the role of autonomous attackers. He warned leaders to design controls for continuous, adaptive, and machine-driven threats.
Second, businesses must inventory all identities — humans, workloads, APIs, and AI agents — because unmanaged identities pose unmanaged risk.
Third, least privilege must be enforced by default, especially for non-human access, and should be both purpose-bound and time-bound.
Fourth, leaders must monitor behaviour, not just access.
Finally, organisations must automate containment because manual response will not scale.
Lastly, as cybersecurity practices become a board-level concern, metrics matter. Guccione advised directors to track indicators of risk reduction rather than surface-level activity.
These include the ratio of managed to unmanaged NHIs, the percentage of machine identities using short-lived credentials, time-to-revoke compromised access and the number of high-privilege identities without clear ownership.
In 2026, identity security is no longer an IT checkbox. It is the foundation of digital trust — and a strategic layer that determines whether automation accelerates business growth or accelerates business risk.
—
The lead image of this article was generated by AI.
The post Rethinking cybersecurity practices as Non-Human Identities (NHIs) surge appeared first on e27.
