AI
Non-Human Identities Now Outnumber People 50 to 1
Non-human identities now outnumber people 50 to 1, with some estimates reaching 100 to 1. Eighty percent of breaches involve an NHI. Service accounts, containerized workloads, AI agents, API keys, and LLMs all qualify, and most are dynamically generated with little oversight once they start accessing sensitive data.
Four teams share responsibility (IT, SecOps, DevOps, platform engineering) and none owns the full picture. Over half of organizations have no offboarding process for API keys. No centralized governance means attackers find NHIs before defenders do.
Three Requirements for PKI-Based NHI Security
PKI certificates carry the cryptographic identity information needed to authenticate every service interaction, including mutual TLS where workloads verify each other before exchanging data. Access policies can then read certificate metadata to authorize just-in-time, least-privilege access without separate credential stores.
The third requirement is scale. Public certificates once expired after two years, then one year. The mandate now caps them at 42 days, and for AI agent workloads Varadharajan puts target TTLs at:
“TTLS on the order of minutes.” — Vinithra Varadharajan
That volume means issuance, distribution, and renewal must run without human intervention.
Why Traditional Certificate Management Breaks Under Modern Scale
One customer ran a workflow where a certificate expiry took down an application, a ticket went to DevOps, the DevOps team updated manual stores with no version control, the networking team handled device certificates separately, and the fix took 3 to 7 days. That delay is the real reason certificates carried year-long TTLs: renewals were too painful to run often.
The same pattern repeats across the industry. No central visibility, no policy enforcement, multiple tools, and security treated as an afterthought. A shorter TTL mandate only makes this worse unless the renewal process is automated first.
How Vault Automates PKI Lifecycle Management
Vault automates X.509 certificate issuance with no humans in the loop, issuing as many short-TTL certificates as the workload demands. The Vault agent runs alongside an application, requests certificates at runtime, and renews them before expiry without an app restart. On Kubernetes, the Vault Secrets Operator handles this natively and triggers rolling pod restarts on rotation.
The CA hierarchy uses an offline root, an intermediate CA at 6-month TTL, and a leaf-issuing mount at 30 days. Terraform codifies cluster setup. Path-based filters enforce geographic data boundaries for GDPR compliance.
Live Demo and Upcoming Protocol Support
In the certificate issuance and revocation demo on OpenShift (17:45), Mills added a store app entity to a Vault group. The app received a certificate with a 30-second TTL, and metadata showed the human owner and business unit. Removing the entity from the group stopped renewal within 30 seconds, taking the app offline.
Three new hardware protocols are shipping: EST for IoT, CMPv2 for network devices, SCEP for MDMs. SPIFFE authentication is on the roadmap, letting any SPIFFE-compliant workload authenticate with Vault via its SVID. Post-quantum algorithm support follows.
Notable Quotes
human identities 50 to1 right now. David Mills · ▶ 2:20
Never trust, always verify. Vinithra Varadharajan · ▶ 7:00
TTLS on the order of minutes. Vinithra Varadharajan · ▶ 8:19
Key Takeaways
- NHIs outnumber humans 50 to 1 and account for 80% of breaches, yet most lack lifecycle governance.
- Short-lived PKI certificates with automated renewal eliminate the manual ticketing workflows that force long TTLs.
- Vault’s path-based policies and default-deny model let teams revoke NHI access in under 30 seconds.