# What should a non-human identity audit checklist include in 2026?

Charlotte Higgins · August 27, 2026

> Why Non-Human Identities Demand Their Own Audit Discipline By August 2026, most enterprise breach post-mortems attribute initial access to service...

## Why Non-Human Identities Demand Their Own Audit Discipline

By August 2026, most enterprise breach post-mortems attribute initial access to service accounts, API tokens, OAuth client secrets, or machine credentials rather than stolen employee passwords. The reason is structural: every microservice, data pipeline, SaaS integration, and AI agent needs an identity, and that identity tends to live longer than the workload that created it. A non-human identity audit checklist is a repeatable control set that inventories these machine actors, measures their risk, and forces remediation before attackers discover orphaned secrets. Treating NHIs as a separate audit domain prevents them from being absorbed into generic IAM reviews, where human-centric assumptions (90-day password rotation, MFA, leaver workflows) simply do not apply.

**Also worth reading:** [What does an agentic AI audit checklist look like for 2026 product architectures?](https://graftconcepts.com/knowledge/what_does_an_agentic_ai_audit_checklist_look_like_for_2026_product_architectures.php) · [What is a non-human identity governance framework and why does it matter for AI product innovation in 2026?](https://graftconcepts.com/knowledge/what_is_a_non-human_identity_governance_framework_and_why_does_it_matter_for_ai_product_innovation_in_2026.php) · [What is AI agent identity lifecycle management and how do organizations govern non-human digital workers?](https://graftconcepts.com/knowledge/what_is_ai_agent_identity_lifecycle_management_and_how_do_organizations_govern_non-human_digital_workers.php)

The discipline differs from human identity governance in three ways. First, NHIs outnumber human users by ratios between 10:1 and 50:1 in mature cloud estates, so manual review is impossible without automation. Second, ownership is ambiguous: the engineer who deployed a Lambda function may rotate teams, while the service principal persists for years. Third, the blast radius of a leaked machine credential is often broader because NHIs carry programmatic access to entire data domains. These three factors are why a structured audit checklist, applied quarterly or after every major platform change, outperforms ad hoc clean-up sprints.

## Core Sections of a 2026-Ready NHI Audit Checklist

A defensible checklist contains ten logical sections. Each section maps to a specific failure mode observed in production environments between 2024 and 2026, and each produces measurable evidence rather than subjective judgments. The sections are: inventory completeness, ownership attribution, credential hygiene, privilege scope, lifecycle alignment, session and token management, secret storage, observability, governance accountability, and remediation velocity. Together they cover the full lifecycle from provisioning to decommission.

Inventory completeness asks the foundational question: do you actually know how many machine identities exist? Most organizations discover 30-60% more NHIs than they expected once they correlate cloud provider logs, vault audit trails, CI/CD run metadata, and SaaS audit logs. Ownership attribution requires that every NHI have a named accountable human or team, not a shared mailbox. Credential hygiene covers rotation frequency, algorithm strength, and the absence of hard-coded keys. Privilege scope evaluates whether the identity has more permissions than its function requires, particularly dangerous in agentic AI systems that may inherit broad read scopes. Lifecycle alignment verifies that NHIs expire when the workload that created them is retired. Session and token management covers OAuth refresh token TTLs, JWT lifetime, and the absence of long-lived bearer tokens. Secret storage checks for any credential outside a managed vault. Observability confirms that every NHI action is logged with enough fidelity for forensic reconstruction. Governance accountability ties NHIs to a policy owner, a review cadence, and a budget. Remediation velocity tracks how quickly the organization closes findings.

## How to Build the Inventory in Practice

The first operational step is reconciling identity sources. Pull the full list of service principals from your IDP, federated roles from each cloud account, workload identities from Kubernetes, machine accounts from your SIEM, and API clients from your SaaS admin consoles. Deduplicate using the credential fingerprint or the OIDC issuer-subject pair, not the human-friendly display name, which is unreliable. The output is a single table where every row represents one unique NHI with columns for creation date, last used date, source system, credential type, and owning team.

In practice this reconciliation uncovers three classes of problem identity. Dormant NHIs have not authenticated in 90 days or more, yet retain valid credentials. Shadow NHIs were created outside the official IDP, often by a CI/CD pipeline that minted its own service account. Over-privileged NHIs have permission sets designed for the application's peak load, not its steady state. Auditors should flag each class separately because the remediation path differs: dormant identities are candidates for deletion, shadow identities require onboarding, and over-privileged identities need scope reduction. A practical target is to resolve all three classes within 30 days of audit completion, with documented exceptions approved by the CISO.

## Comparison of Audit Approaches

| Approach | Discovery Speed | Coverage Depth | Tooling Cost | Best Fit |
| --- | --- | --- | --- | --- |
| Manual spreadsheet review | Slow (weeks) | Low, misses shadow NHIs | Minimal | Sub-100 NHI environments |
| Cloud-native IAM inventories (AWS IAM Access Analyzer, Azure Entra, GCP IAM) | Fast (hours) | High within one cloud, partial cross-cloud | Included in cloud spend | Single-cloud estates |
| Dedicated NHI platforms (Avalor, Astrix, Clutch, Entro, Orca) | Fastest (minutes) | Highest, correlates across IDP, vault, cloud, SaaS | $50k-$500k annually | Multi-cloud, regulated industries |
| SIEM-based correlation (Splunk, Sentinel, Chronicle) | Medium | Medium, depends on log quality | Existing license | Teams with mature SOC |
| Open-source scripts (Steampipe, Powerpipe, custom Python) | Medium | High if tuned | Engineering time | Budget-constrained, skilled teams |

The right choice depends on NHI count, regulatory pressure, and existing skill sets. A mid-sized organization running 2,000-10,000 NHIs across two clouds usually gains the most from a dedicated NHI platform, while a 200-NHI startup can succeed with native cloud tools. The worst outcome is a manual spreadsheet in any environment above 500 identities, because it guarantees findings will be out of date within weeks.

## Common Mistakes That Undermine NHI Audits

The most frequent failure is treating the audit as a one-time project rather than a recurring control. NHIs multiply faster than human users, and a checklist run only annually will be obsolete by month four. A second mistake is using creation date as a proxy for risk. A 2021 service account that authenticated five minutes ago is more dangerous than a 2025 identity that has never been used, yet age-based dashboards often flag the newer identity for review. Third, auditors frequently focus on credentials and ignore permission scope. A perfectly rotated, securely stored credential with administrator-equivalent scope remains a critical risk. Fourth, organizations neglect service accounts in legacy ERP and on-premise systems because they sit outside cloud-native tooling; the August 2026 ERP security market still reflects this gap, with platforms adding NHI discovery as a feature rather than a foundation. Fifth, teams treat AI agent identities as a future problem and exclude them from current scopes, even though agentic systems are already in production at most enterprises with mature MLOps programs. Finally, audits often stop at discovery and never close the loop with a remediation ticket and a deadline.

## Practical Steps to Operationalize the Checklist

Begin with a 90-day pilot scoped to one business unit and one cloud provider. The pilot should produce five artifacts: a deduplicated inventory, a risk score per NHI, a top-20 remediation list, a policy draft assigning ownership rules, and a measurement of mean time to remediate. Once those artifacts exist, expand to the remaining cloud accounts and integrate the IDP as the system of record. Automate the inventory step using cloud configuration queries or a dedicated platform so that the list refreshes daily rather than quarterly. Codify ownership rules in code: if an NHI is older than 30 days and has no owner tag, the platform should auto-assign it to the team that owns the underlying resource, or quarantine it if no team can be inferred.

Policy should mandate a maximum credential age of 90 days for symmetric secrets, OAuth refresh tokens under 24 hours for high-trust scopes, and immediate revocation on workload retirement. The audit checklist should require evidence for each control, not assertions: the actual rotation timestamp from the vault, the actual token TTL from the IDP, the actual last authentication log. Run tabletop exercises where a red team steals a single high-scope NHI credential and try to detect and contain the lateral movement within 15 minutes; the gaps that surface become next quarter's audit priorities. Finally, report NHI risk to the board using the same dashboard used for human identity risk, because framing parity signals that NHIs are not a secondary concern.

## When to Act and What It Costs

The signal to begin a formal NHI audit is not a breach but a structural change. Adopt the checklist within 60 days of any of these events: migration of more than 20% of workloads to a new cloud provider, deployment of an AI agent platform that creates identities programmatically, an acquisition that brings a new IDP into scope, or a regulator inquiry about machine access. Costs vary by approach. Native cloud tooling is included in existing spend but requires 0.5-2 FTE for tuning. Dedicated platforms list between $50,000 and $500,000 annually depending on identity count and modules, with most mid-market buyers landing in the $80,000-$150,000 range. Open-source pipelines cost engineering time, typically 1-3 FTE for the first build, with low marginal cost thereafter. The cost of inaction is harder to quantify but observable in incident response: containment time for a credential-based breach averages 277 days according to multiple 2024-2026 datasets, and NHIs are involved in roughly 40% of those cases.

A practical budget rule is to spend at least 10% of your total identity program budget on NHI-specific tooling and headcount, even if NHIs represent 80% of your identity count. Underinvesting in NHIs while overinvesting in human identity controls is a common pattern that auditors flag and attackers exploit.

## Quick answers

### How often should a non-human identity audit be run?

High-maturity organizations run continuous discovery with a formal checklist review every 90 days. Annual reviews are insufficient because NHIs multiply faster than human users; a year-old inventory is typically 30-60% incomplete within six months.

### What is the difference between NHI and machine identity?

The terms are used interchangeably in most vendor literature, but NHI often emphasizes the identity-and-access-management framing (who is the principal, what can it do), while machine identity emphasizes the credential (key, certificate, token). A complete audit covers both the principal and its credentials.

### Do AI agents need their own audit category?

Yes. Agentic AI systems create identities that can spawn sub-agents, hold delegated user authority, and act autonomously for hours. Standard NHI controls do not fully cover these behaviors, so a 2026 checklist should include a sub-section for agentic identity scope, goal constraints, and human-in-the-loop checkpoints.

### What is the single highest-impact control on an NHI checklist?

Assigning a named human owner to every NHI produces the largest risk reduction per unit of effort. Without ownership, no other control survives contact with organizational turnover. Ownership is also the prerequisite for privilege reviews and timely decommissioning.

### Can small teams audit NHIs without enterprise tools?

Yes, for sub-500 identity environments. Native cloud inventory tools, combined with open-source SQL queries against vault logs, are sufficient. The limitation is cross-cloud correlation; once a team operates in more than one cloud, dedicated tooling pays for itself within one audit cycle.

Canonical: https://graftconcepts.com/knowledge/what_should_a_non-human_identity_audit_checklist_include_in_2026.php
Markdown: https://graftconcepts.com/knowledge/what_should_a_non-human_identity_audit_checklist_include_in_2026.php/index.md