Organisations are increasingly shaped by automation, cloud services, highly dynamic IT landscapes and AI-supported processes. At the same time, new digital identities are emerging at speed that are not necessarily tied to a person and can still access critical systems.  

These identities work in the background. They connect applications, control interfaces or run automated processes. The same goes for AI agents. They go a decisive step further: they increasingly act autonomously, adapt their behaviour and are therefore less predictable than classic automation. This is exactly what opens up new possibilities – and creates new risks. It is like an orchestra playing without visible musicians: a lot seems to happen by itself. But behind every action there is an actor. What matters is that we know who is playing, which role is intended and who is responsible for each entry.

What makes them a risk?

Many non-human identities are hard to see, lack clear ownership or hold overly broad privileges. An old service account, an unrotated API key or an over-privileged AI agent can quickly become an entry point for attackers.

Particularly critical: classic security mechanisms for human users often do not apply here. A machine does not use an MFA app. An agent does not confirm a login. That is why other forms of control are needed.

What companies should review

Organisations need to know which non-human identities exist, what rights they hold, what they are used for, what they do and who is responsible for them.

Clear rules for the creation, use, review and removal of these identities are decisive. Only then can risks be reduced, access be traced and compliance requirements be met.

Why AI agents intensify the issue

With AI agents, a new class of non-human identities is emerging. They can

Execute tasks autonomously, connect systems and trigger actions. They therefore need their own permissions, clear accountability and continuous control.

The question is no longer only: Who has access? But also: Which non-human identity is acting right now – and is it allowed to?

What KOGIT means by this

For KOGIT, Non-Human Identities are a central component of modern Identity Security. Organisations must secure not only people, but every identity that can access, act or trigger decisions.

KOGIT helps make Non-Human Identities visible, assess risks and build governance structures that keep pace with automation, cloud and AI agents. To turn many independently acting players into a coordinated ensemble, clear responsibilities, appropriate permissions and continuous control are needed.

Conclusion

Non-Human Identities in general and autonomously acting AI agents in particular are no longer a technical side issue. They are an essential part of the security-critical architecture of modern organisations.

Anyone who wants to make Identity Security future-ready must also control the identities that are not assigned to a real person.“