Executive Summary: In Part-1 blog titled: “API Sprawl Is Real: What SAP BTP Teams Need to Know”, we outlined the shift from monolithic SAP systems to distributed, API-heavy, multi-cloud environments and the resulting explosion of non-human identities (NHIs). In this part, we focus on why NHIs—and now AI agents—represent the most significant unmanaged risk across today’s SAP estates.
Non-human identities (NHIs) are no longer a niche topic. With cloud-native services, SAP Business Technology Platform (SAP BTP), automation, microservices, integration pipelines, and now AI agents, NHIs have become the dominant identity type across enterprise environments. Yet most security models, audit controls, and governance frameworks still center on human users — creating a serious blind spot.
NHIs don’t behave like humans. They don’t resign, rotate passwords, or raise tickets. They don’t alert anyone when they go unused. They simply persist — silent, persistent, and highly privileged.
Let’s break down why NHIs (including AI agents) are so risky, how they bypass traditional governance, and why human-centric IAM and GRC tools fail to protect them.
What Are NHIs (Now Including AI Agents)?
Non-human identities (NHIs) represent any digital entity that can authenticate, access systems, or perform actions without direct human intervention. In a modern SAP and cloud-native landscape, NHIs take many forms, including:
- Service keys generated by SAP BTP service instances
- OAuth clients and client-secret credentials
- API tokens used by integration flows, scripts, or automation bots
- Certificates used by microservices, destinations, or secure endpoints
- Technical users or service accounts in SAP IAS/IDM or ABAP systems
- AI agents and autonomous bots, including “agentic automation” systems that can call APIs, trigger processes, or create new automation steps without ongoing human prompts
As enterprises expand their use of AI, automation, and microservices, the volume of machine identities grows exponentially—often far faster than the human workforce. Recent industry research highlights how quickly this shift is accelerating (CyberArk, BusinessWire).
Why NHIs (and AI Agents) Are Fundamentally Riskier Than Human Accounts?
NHIs introduce a different class of risk because they don’t follow the lifecycle of a human user — and traditional controls were never designed for them. Key reasons include:
- They don’t expire on their own.
Human accounts get disabled when employees leave. NHIs — service keys, automation bots, AI agents — often remain active indefinitely unless someone manually tracks and removes them. - They are frequently over-privileged.
During development or integration, teams grant broad access just to “get things working.” Those elevated privileges usually stay in place long after the project goes live. - Their secrets are long-lived and shared across environments.
Service keys, OAuth credentials, and certificates are often copied across dev, QA, and production — expanding the blast radius of a single compromise. - They bypass human-focused security checks.
NHIs don’t use MFA. They don’t reset passwords. They aren’t tied to HR processes. Most IAM and GRC toolchains treat them as afterthoughts, leaving them largely ungoverned. - AI agents multiply complexity at machine speed.
Autonomous agents can create new credentials, call APIs across systems, activate pipelines, or spin up microservices without human oversight — accelerating identity sprawl and making visibility even harder.
Together, these factors create ghost credentials — powerful, persistent, and often completely unmonitored identities living deep inside your landscape.
How Common Are NHI-Related Security Issues? Here’s What The Data Says:
Independent research points to the same conclusion: non-human identities are now one of the fastest-growing sources of security exposure in enterprise environments. The scale, fragmentation, and lack of lifecycle governance are driving a clear rise in incidents.
Here’s what the data makes clear:
- Machine identities now outnumber humans 80:1.
A CyberArk study found that modern cloud landscapes contain eighty times more machine identities than human accounts — a dramatic shift in the security baseline. - Nearly half of enterprises have faced an NHI-related incident.
Research from AppViewX reports that almost 50% of organizations experienced issues tied to unmanaged NHIs — including expired certificates, exposed API keys, and abandoned service accounts. - NHI exposures now rival human-identity breaches.
CyberDefense Magazine highlights non-human identity failures as a major contributor to cloud security breakdowns.
Across all three datasets, the message is consistent: NHIs are exploding in volume, remain weakly governed, and are directly responsible for real-world security incidents — often at a scale that surpasses human identity risk.
Why Existing SAP & Security Tools Fail To Keep Up With NHI Risk?
SAP-native IAM, GRC, and credential vaults were all designed around human identities. But NHIs follow a completely different lifecycle — they multiply faster, live longer, and carry broader privileges. This mismatch leaves enterprises with gaps that traditional tools simply weren’t built to close. Let’s take a closer look:
SAP-native IAM and GRC tools are built for humans — not NHIs
- SAP IAS / IPS focus on human authentication and federation.
- SAP Access Control (GRC) is designed for Segregation of Duties, firefighter access, and human user provisioning.
- BTP role collections and subaccount roles manage authorizations, not the lifecycle of machine credentials.
None of these tools automatically discover NHIs, enforce rotation, assign ownership, or provide audit trails for service keys, OAuth clients, AI agents, or certificates.
Credential vaults and secret stores help — but only partially
Solutions like HashiCorp Vault or the SAP BTP Credential Store provide secure storage, but they fall short in key areas:
- They require manual onboarding of secrets.
- They cannot automatically discover credentials across BTP service keys, OAuth clients, destination certificates, integration flows, or AI-agent tokens.
- They offer vaulting but not full lifecycle governance — no automated rotation, retirement, or metadata management.
The Governance Gap
With IAM focused on humans and vaults focused on storage, enterprises are left with a significant governance gap:
- No authoritative inventory of all NHIs
- No ownership or accountability model
- Limited visibility into unused or over-privileged credentials
- No automated rotation or retirement processes
- No audit-quality traceability
This gap is exactly what attackers exploit — through leaked API keys, abandoned service accounts, long-lived credentials, or compromised automation bots.
The Emerging Amplifier: AI Agents and Automation
AI agents and automation pipelines are driving rapid growth in non-human identities across enterprise systems. Every new agent, integration flow, or microservice creates fresh API keys, OAuth clients, certificates, or service accounts — often with long validity periods and no clear owner.
Recent breaches on how a former Coupang employee exfiltrated customer information, because of poor access-rights management, indeed portray the danger of leaving these identities unmanaged. In one incident, a long-lived authentication token tied to a former employee remained valid because the underlying keys were never rotated. That single lapse enabled access to internal systems without a normal login. A similar failure occurred when a telecom provider reused the same certificate across thousands of devices for nearly a decade, allowing unauthorized systems to enter the network.
These cases highlight a broader issue: machine credentials continue to live long after the humans behind them leave. When AI agents create, distribute, or reuse secrets at scale, this problem multiplies. Without unified governance, NHIs become the most attractive entry point for attackers.
Any modern SAP BTP security program must address this growth directly by enforcing lifecycle controls, automated rotation, ownership, and consistent governance for all machine identities — not just human users.
Wrapping Up: A Blind Spot You Can’t Ignore Anymore
Non-human identities are now the largest, fastest-growing identity class inside SAP landscapes. They move across services, pipelines, and automation layers without the lifecycle checks that protect human access. And with AI agents creating credentials at machine speed, the gap widens even further.
This series will continue to break down the challenges and the real fixes.
The next article will cover -how attackers actually exploit these non-human accounts, why existing controls fail, and why enterprises are increasingly exposed.
Stay tuned, this is just the start !!!
Read Part 1 here: API Sprawl Is Real: What SAP BTP Teams Need to Know
Frequently Asked Questions
- What exactly is a non-human identity (NHI)?
An NHI is any digital identity that can authenticate and act without a human user. Examples include API keys, service accounts, certificates, OAuth clients, service keys, and AI agents.
- Why are NHIs riskier than human accounts?
NHIs don’t expire by themselves, often hold broad privileges, bypass human-oriented security controls, and rarely go through offboarding. They persist silently and can accumulate access over time.
- How do AI agents increase the risk?
AI agents can autonomously create new credentials, call APIs, activate pipelines, or spin up microservices. This accelerates identity sprawl and makes it harder to track, rotate, or retire secrets.
- How common are NHI-related security incidents?
Research shows machine identities now outnumber humans 80:1, and nearly half of enterprises have experienced issues tied to unmanaged NHIs—such as expired certificates, exposed API keys, and abandoned service accounts.