Identity Security Insights
Before rushing to solve NHI, look human identity in the mirror
Without a robust human identity foundation, any investment in non-human identities amplifies chaos instead of containing it. Why the next wave of identity governance isn't won by skipping layers.
Executive summary. The identity and access conversation in 2026 is dominated by non-human identities: autonomous AI agents, service accounts, OAuth tokens, machine secrets. The data backs the noise: NHIs outnumber human employees by up to 50 to 1, and account for 74% of identities involved in breaches. The market's natural reaction is to package "NHI solutions" as a new service line. This post argues the opposite: without a robust human identity governance foundation — IGA with automated joiner/mover/leaver, PAM with credential rotation and session recording, periodic access certifications — any NHI investment amplifies chaos instead of containing it. The human layer and the non-human layer are not sequential problems, they are a single ecosystem. But the remediation priority is sequential. And that is where the opportunity lies for the MSPs, MSSPs and VARs that know how to frame the conversation with their clients.
The illusion of the generational leap
There is a commercial pattern that repeats every time a new category appears in cybersecurity: the client, overwhelmed by the volume of analyst alerts, vendor blogs and RSA demos, assumes that the latest layer to emerge is the one they need to solve first. In 2018 it was Zero Trust. In 2021 it was XDR. In 2024 it was CNAPP. In 2026 it is NHI and AI agent governance.
The reflex is understandable. When Gartner, CSA and NIST publish in the same quarter frameworks like MAESTRO, COSAiS and the Agent Trust Protocol, when OWASP releases its Top 10 for Agentic Applications, and when every Fortune 500 CISO mentions "non-human identity" in their keynote, the natural cognitive bias is to assume that's the most urgent problem of the moment. It isn't necessarily. It's the most visible problem.
The question that a mature MSP, MSSP or VAR has to help frame at the client's table is not "how do we govern AI agents?" but an earlier and more uncomfortable one: how robust is our human identity governance today? Because the two layers do not get solved in silos. They condition each other. And if the human foundation is broken, NHI investments will inherit the cracks at machine speed.
Three numbers that look contradictory — and aren't
The conversation becomes clearer when three figures circulating in the 2026 identity literature are put side by side:
| Indicator | Value | Reading |
|---|---|---|
| NHI to human identity ratio in modern enterprises | 50 : 1 | Non-human volume is the largest problem on the surface |
| Non-human identities involved in breaches | 74 % | When the incident occurs, an NHI is almost always touched |
| Initial attacks exploiting weak or reused human credentials | ~80 % | The entry vector remains overwhelmingly human |
At first glance they look incoherent: if 80% of attacks enter through a human credential, why are 74% of the identities involved in breaches non-human? The answer is precisely this post's argument: the attacker enters through the human layer and moves, escalates and persists through the non-human layer. The human opens the door, the NHIs are the maze that stays unbreachable for months.
What this means operationally is important: if an organization invests in AI agent governance while maintaining an immature human identity program, it is paving the upper floors of a house whose ground floor is still wide open. The attacker will keep walking in the same way — phishing, credential stuffing, MFA fatigue — and will now find an even broader universe of machine identities to propagate over, with "governance" acting as compliance theater.
The causal chain that changes the conversation with the client
There is a logical sequence that helps explain to a CISO why priority matters, without falling into the dogma of "human first, then no NHI." Reality is more nuanced. The two layers co-evolve, but the quality of the human layer determines the quality ceiling of the layers above it.
Layer 1 — Human identity baseline. If there is no automated joiner/mover/leaver process against the HR system, if employees accumulate permissions as they move between teams (privilege creep), if contractor and partner accounts persist for months after departure, then there is no way to guarantee that any layer above is clean. Every NHI is born tied to a human who created it or operates it. If that human shouldn't have access anymore, the NHI shouldn't either — and yet it does.
Layer 2 — Privileged human access. Administrators, DevOps, platform engineers. If this layer doesn't have automated credential rotation, session recording, just-in-time access and separation of duties (SoD), then every administrator compromise is also a compromise of the secret catalog that administrator can see. And those secrets contain NHIs.
Layer 3 — Service identities and secrets. Now we are in traditional NHI territory: service accounts, API keys, certificates, tokens. If layers 1 and 2 aren't mature, this layer inherits two problems: zombie identities (created by humans who are gone) and secrets rotated by humans with privileges they shouldn't have. The NHI lifecycle — discovery, provisioning, monitoring, rotation, decommissioning — doesn't work if the human layer doesn't deliver reliable ownership information.
Layer 4 — Autonomous AI agents. This is the layer that generates the most headlines. Agents reason, delegate tasks, operate tools. CSA's MAESTRO framework, the ATP, NIST's COSAiS overlays, the OWASP Agentic Top 10 — they all start from an assumption worth making explicit: that the agent has its own identity, tied to a responsible human, with explicit delegated authority. If layer 1 doesn't produce clearly identified responsible humans, no delegation protocol works, because there's no verifiable "delegator." The agent becomes orphaned by design.
The operational conclusion is direct: you can start working on all four layers in parallel, but the achievable quality in layers 3 and 4 is capped by the maturity of layers 1 and 2. This is not an opinion, it is a structural property of the problem.
Symptoms of immature human governance
Before proposing a solution, you need to be able to show the problem. These are the markers that a technically literate MSP/MSSP/VAR sales team can surface in a discovery conversation, without a formal audit:
- Orphan accounts. How many active identities in Active Directory or Entra ID don't have a manager registered in HR? If the number exceeds 5% of the directory, there is human identity technical debt.
- Privilege creep. Is there a periodic permission review policy? If members of the IT or development team still hold access from projects closed two years ago, SoD is not a practice, it's an aspiration.
- Inconsistent MFA. Is MFA coverage 100% on critical applications, or are there "compatibility" exceptions that have been open for three years?
- Absent access certifications. Do managers certify their team's access quarterly? If the answer is "we do it once a year for audit," the control exists on paper but doesn't operate.
- PAM without session recording or JIT. Do administrators share vault credentials but keep sessions open indefinitely? PAM only protects when it enforces time windows and leaves an auditable trail.
- Phantom decommissioning. When an employee resigns, what happens to the OAuth tokens they generated, the SSH keys they uploaded, the SaaS integrations they authorized? If the answer is "we disable the user in AD," the problem is structural.
If three or more of these symptoms appear, the client isn't ready for a serious conversation about NHI or AI agent governance. They're ready for a human identity remediation conversation — which is exactly the conversation an MSP/MSSP/VAR with technical capability across CyberArk, Delinea and SailPoint can credibly lead.
The opportunity for MSPs, MSSPs and VARs
The commercial argument is counterintuitive, and that's why it works. While most of the channel is repositioning as "NHI experts" or "AI agent security consultants" — new categories, scarce talent, limited success stories, long sales cycles — the real market is asking for something else: someone who can mature the human foundation and at the same time have the technical credibility to lead the NHI conversation when the client is ready.
This translates into three concrete moves for an MSP/MSSP/VAR owner:
1. Change the first pitch to the client. Instead of opening with "we have services to govern AI agents," open with "before investing in NHI, let's do a human identity maturity assessment together." It sounds less brilliant but produces two effects: it positions the partner as technically honest, and it opens a 30-90 day project that otherwise wouldn't exist. The assessment project is the Trojan horse of the remediation program.
2. Secure full-stack technical coverage. A client who closes the assessment with remediation conclusions needs execution capacity in CyberArk, Delinea or SailPoint — the platforms that cover both the privileged human layer and, eventually, the NHI and agent layer. Having engineers with hands-on experience across at least two of these platforms is what separates the consultative partner from the executor partner.
3. Design the offer as a roadmap, not as a point product. The client doesn't buy "a PAM implementation" — they buy a 12 to 18 month roadmap that starts with automated joiner/mover/leaver and access certifications, continues with session recording and JIT, integrates secret and service account management, and ends with AI agent governance under frameworks like ATP or the COSAiS recommendations. That roadmap is defensible before the client's audit committee because it follows a structural logic, not a commercial one.
The partner who sustains this argument is the one who captures the client's full identity budget over the cycle. The one who positions only on NHI competes with many others for a fraction of the budget and a use case still being shaped.
Where Telekomplex fits in this conversation
Telekomplex exists precisely for this market gap. Senior talent with hands-on experience across CyberArk, Delinea and SailPoint is scarce and expensive in the United States, and the rate of stalled or under-staffed identity projects within MSPs, MSSPs and VARs because of missing technical capacity is high. Telekomplex's model solves this with full-time LATAM engineers, engaged as dedicated employees or contractors of US-based partners, capable of covering the full cycle: design, deployment, account onboarding, joiner/mover/leaver automation, access governance, integrations with AD, Entra ID, LDAP, SAML, SCIM, audit-readiness for SOC 2, PCI DSS, HIPAA, ISO 27001 and SOX, and ongoing program operations.
What matters for this post's argument is that Telekomplex's technical scope is not limited to the NHI layer nor the human layer — it covers the full stack. That lets a partner offer their end client a coherent proposition: first remediation of human and privileged identity, evolution into service account and secret management, and incorporation of AI agent governance when the business case justifies it. The same engineering team accompanies all four layers. The partner owns the commercial relationship and the account; Telekomplex contributes the specialized technical capacity that is hard and expensive to build internally.
For the MSP/MSSP/VAR deciding how to position itself in the 2026 identity conversation, the practical question is: does your team have the capacity to sustain a 12 to 18 month identity program across the three leading platforms, or do you need a partner that extends your capacity without growing fixed headcount? If the answer is the second, the conversation with Telekomplex is the natural one.
The question worth taking to your next client meeting
To close, a practical invitation for the reader who is an owner or head of services at an MSP/MSSP/VAR. In your next discovery meeting with a client asking about "identity strategy for AI agents" or "how we control NHIs," try opening with this question before presenting any offer:
"Before we talk about agents and NHI, how confident are you that, if an employee resigned last Friday, every one of their access paths is revoked today — including the OAuth tokens they generated in third-party SaaS, the SSH keys they uploaded to repos, and the service accounts they themselves provisioned?"
If the client can answer that question with confidence and data, they are ready for an AI agent governance conversation. If they can't, they've just discovered the first project on the roadmap. And at that moment, the most valuable thing a partner can offer is not a point solution but the capacity to accompany all four layers in order — with expert talent, a flexible engagement model, and a structural argument that the client's CISO can defend before their own committee.
That's the conversation we're having with partners across the United States. If you want to explore it for your installed base, write to us at contact@telekomplex.net and let's schedule a 30-minute session to review your identity opportunity pipeline and where the highest-value first move is.
Telekomplex is a US-based company headquartered in Seattle, Washington, providing full-time engineering capacity to MSPs, MSSPs and VARs across the United States. Our Identity Security practice covers design, implementation and ongoing operations across CyberArk, Delinea and SailPoint, with full coverage of the human, privileged, machine and AI agent identity stack.
Reference sources: Cloud Security Alliance (MAESTRO, Agentic Trust Framework), NIST (COSAiS, AI Agent Standards Initiative), OWASP (Top 10 for Agentic Applications 2026), Gartner, Cisco (Zero Trust for Agentic AI), Ping Identity, Vectra AI, Palo Alto Networks, Netwrix, GitGuardian.