Why NHI
RSA Conference marked its 35th year under the theme 'The Power of Community,' but a single keyword cut through the exhibition floor and session rooms: Non-Human Identity. CSO Online named NHI governance one of RSAC 2026's top five agenda items — the first time the topic has been addressed at this scale on the conference stage.
of organizations experienced identity-related incidents in the past year, with 70% originating from AI-related activities.
Microsoft 2026 Secure Access Report
The numbers explain why. In enterprise environments, non-human identities — service accounts, API keys, bots, and AI agents — outnumber human identities 100:1. Microsoft's 2026 Secure Access Report found that 97% of organizations experienced an identity-related incident in the past year, with 70% of those originating from AI-related activity. A joint CSA and Aembit study revealed that 68% of organizations cannot distinguish AI agent activity from human activity. IDC projects up to 1.3 billion AI agents in operation by 2028, each requiring governance on par with a human user.
The NHI market is broadly divided into three approaches — but what RSAC 2026 made clear is that all three are converging into a single, unified NHI lifecycle management discipline.
“By 2027, your smartest employee will be a machine. Yet most organizations are deploying AI agents with less governance than they give an intern.”
“The moment identity operates at machine speed and scale, traditional security models collapse.”
of organizations cannot distinguish between AI agent activities and human activities in their environments.
CSA & Aembit Joint Survey
First Approach: Shift-Left — Catch Secrets Before They Leak
This approach detects and blocks secrets before they are exposed — across code, CI/CD pipelines, containers, and IaC. It is the category most faithful to the principle that prevention is the best cure.
hardcoded secrets were added to public GitHub in 2025 alone — a 34% increase YoY and the largest single-year jump ever recorded.
GitGuardian State of Secrets Sprawl 2026
GitGuardian
#3332The vendor that brought the strongest data to RSAC 2026. Their State of Secrets Sprawl 2026 report documented 28.65 million hardcoded secrets added to public GitHub in 2025 — a 34% year-over-year increase and the largest single-year spike on record. AI service secrets surged 81% to 1.27 million incidents. GitGuardian's detection engine runs 482+ detectors and scans 1.1 billion commits per day, with active validation to confirm whether discovered secrets are still live.
- 482+ detectors plus Honeytokens capability
- 64% of critical secrets leaked in 2022 were still valid as of January 2026
- One-click revocation for GitHub, GitLab, and OpenAI secrets
- Expanding into NHI governance with OWASP NHI Top 10 risk scoring
Truffle Security
TruffleHog is the leading open-source secrets scanning engine with 24,500 GitHub Stars and 250,000+ daily scans. It detects 800+ secret types and performs real-time validation to confirm whether discovered credentials are live. The GCP Analyze add-on maps blast radius — identifying exactly which resources a leaked secret can access within a GCP environment.
- 800+ secret types detected
- Real-time credential validity verification
- GCP Blast Radius analysis
Cremit
A Korean security startup providing a CLI secrets detection tool based on pattern matching, entropy analysis, and keyword detection. Cremit has conducted research on secrets exposure in frontend code running on Vercel, and placed 3rd at the BSidesSF Cloud Village CTF and 2nd at the RSAC Cloud Village CTF during RSA Week — demonstrating real-world cloud security expertise on the international stage.
- 3rd place — BSidesSF Cloud Village CTF
- 2nd place — RSAC Cloud Village CTF
- Research on Vercel frontend secrets exposure
Second Approach: Vault — Centralized Management and Dynamic Credential Issuance
Instead of hardcoding secrets in code, this approach centralizes them in a vault and uses dynamic credential issuance and automatic rotation to minimize blast radius when a leak occurs. Where Shift-Left prevents leaks, the Vault approach limits damage when they happen.
of critical secrets that were valid in 2022 are still valid as of January 2026 — meaning leaked credentials persist for years.
GitGuardian 2026
CyberArk + Venafi
Following Palo Alto Networks' $25B acquisition of CyberArk in February 2026, CyberArk's PAM and Conjur secrets management capabilities merged with Venafi's machine identity and certificate lifecycle management. The combined platform governs every type of machine identity — from service accounts and API keys to certificates and AI agents — in a single platform.
- Unified PAM + secrets management + certificate management platform
- JIT access and least-privilege enforcement for AI agents
- Kubernetes sidecar-based secret injection via Conjur
Delinea
N-4235The boldest Vault vendor proposal at RSAC 2026. Following its acquisition of StrongDM for JIT runtime authorization, Delinea introduced industry-first hardware-attested AI agent authorization. In their Yubico partnership demo, when an AI agent reaches a high-risk decision point — such as a production deployment or privileged configuration change — a human sponsor must physically touch a YubiKey to provide cryptographic approval before the agent can proceed.
- Industry-first YubiKey-based AI agent authorization
- Secret Server + StrongDM + Iris AI unified platform
- StrongDM ID — dedicated identity layer for AI agents (Q2 2026 Early Access)
1Password Unified Access
An agent security platform that starts at the endpoint. 1Password scans developer devices for shadow AI usage, local agents, and exposed credentials, then governs human, agent, and machine credentials in a single encrypted vault. Launch partners include Anthropic, Cursor, GitHub, Perplexity, and Vercel. Already used by 180,000+ businesses.
- NHI visibility starting at the endpoint
- Single vault unifying human, agent, and machine identities
- Runtime Credential Delivery planned for H2 2026
HashiCorp Vault + Akeyless
HashiCorp Vault, now under IBM ownership, is evolving toward combining identity governance with dynamic secrets through integration with IBM Verify. Akeyless is a SaaS-native zero-knowledge secrets management platform, differentiated by DFC (Distributed Fragments Cryptography) — a proprietary encryption method that distributes master key fragments across multiple geographic locations so that no single point can decrypt data.
- Akeyless DFC — distributed encryption with no single-point decryption
- HashiCorp Vault + IBM Verify identity governance integration
- Unified management of static, dynamic, and ephemeral secrets
Third Approach: Threat Perspective — Discover, Monitor, and Control Non-Human Identities
This approach establishes visibility across all non-human identities, detects anomalous behavior in real time, and enforces policy-based access control. Where Shift-Left operates at the code level and Vault at the infrastructure level, this approach governs NHI at the enterprise-wide level. It attracted the most startups and investment at RSAC 2026.
Innovation Sandbox — NHI Dominated the Stage
Geordie AI won the prestigious Innovation Sandbox Contest at RSAC 2026. The competition has produced 100+ M&A exits and $50.1B in total investment over its 20-year history — SentinelOne, Wiz, and Imperva all started here. Each of the 10 finalists received a $5M investment award.
Geordie AI
Geordie AI performs vendor-agnostic AI agent detection using four methods and delivers first visibility in 10 minutes from connection. Its core differentiator is the Beam Risk Mitigation Engine, which intervenes in an agent's decision-making process in real time — modifying context prompts, constraining tool call parameters, or substituting execution paths to mitigate high-risk actions before they materialize. Founded in 2025 by Snyk, Veracode, and Darktrace alumni; member of the CrowdStrike, AWS, and NVIDIA Accelerators.
- First visibility from agent connection in 10 minutes
- Beam Risk Mitigation Engine — real-time intervention in agent behavior
- Coverage of 78+ OWASP Agentic AI Security risk categories
- Broad integrations: LangChain, CrewAI, OpenAI, Claude, Cursor, Devin, and more
Astrix Security
#4225The most aggressively visible NHI startup at RSAC 2026, with a quad-detection architecture providing the broadest AI agent and NHI coverage in the market. Four data sources — AI platform integrations, NHI fingerprinting, EDR sensor telemetry, and BYOS — are unified to detect every NHI including shadow agents. The MCP Secret Wrapper demo at RSAC drew significant attention. $91M raised, $25.1M ARR.
- Quad-detection architecture — AI platforms, NHI fingerprinting, EDR, BYOS
- MCP Secret Wrapper — agents use MCP servers without accessing secrets directly
- Agent Policy Enforcement Engine (Agent Control Plane)
Oasis Security
The pioneer of the NHI-dedicated enterprise platform, closing a $120M Series B right before RSAC — the largest single round in the NHI category (led by Craft Ventures, with Sequoia, Accel, and Cyberstarts). Their AuthPrint technology fingerprints threat actors at the authentication stage, matching behavior against the Oasis NHI Threat Center database to reduce false positives by up to 90%.
- AuthPrint — threat actor fingerprinting at the authentication stage
- AI/ML-based NHI owner auto-assignment (industry first)
- Oasis Scout — first NHI-dedicated ITDR
- 5x YoY ARR growth
Token Security
Innovation Sandbox Top 10 finalist, built by a Unit 8200 alumni founding team. Their Machine-First Identity Security Platform uses agentless scanning and log analysis to build a unified NHI Risk Graph. By correlating static permissions with runtime behavior, it surfaces overprivileged, idle, and shadow assets. Intent-Based Permissioning — aligning access to an agent's purpose rather than its credentials — is the core differentiator.
- NHI Risk Graph — unified analysis of intent, permissions, secrets, behavior, and ownership
- Intent-Based Permissioning — purpose-driven access control for agents
- Global InfoSec Awards: 'Hot Company - Agentic AI Security'
Aembit
An NHI IAM platform specialized in workload-to-workload access control. Its core innovation is secretless, identity-based workload authentication: the Aembit Edge sidecar proxy intercepts requests, verifies workload identity via cryptographic attestation without secrets, and issues short-lived ephemeral tokens. This eliminates 85% of the overhead associated with credential issuance, rotation, and auditing.
- Secretless cryptographic workload authentication
- MCP Identity Gateway — exchanges agent access tokens for MCP server credentials
- Machine MFA — dynamic authorization based on risk posture, time, and location
Silverfort
S-3323The only vendor in the market that sits inline between AI agents and MCP servers as a gateway. While other vendors detect and alert, Silverfort evaluates and blocks every tool call in real time before it reaches the target resource. A key differentiator is legacy identity coverage — including Active Directory service accounts and on-premises identities that most NHI vendors skip.
- Inline MCP gateway — real-time blocking of tool calls
- SSO Enforcement for Agents — correlates every agent session to a human entity
- Coverage of legacy AD service accounts and on-premises identities
Clutch Security
A universal NHI security platform that maps identities across five dimensions using its proprietary Identity Lineage technology: Origin, People Attribution, Storage, Consumers, and Resources. A zero-knowledge architecture ensures sensitive data never leaves the customer network. Ephemeral IDs with automatic expiration continuously validate the legitimacy of NHI usage, eliminating the need for resource-intensive secret rotation.
- Identity Lineage — 5-dimensional NHI mapping (Origin, Attribution, Storage, Consumers, Resources)
- Zero-knowledge architecture — sensitive data processed locally
- Universal NHI MCP Server — first natural-language NHI security query interface
Teleport Beams
S-3111The only vendor providing VM-level agent isolation — each AI agent runs inside a dedicated Firecracker VM. VMs start in 2 seconds, and the filesystem is completely wiped after session end. All network access (internet egress, internal services, inference endpoints) requires explicit whitelisting. 100% of access events are immutably logged with session replay. $1.1B unicorn. MVP launch April 30.
- Firecracker VM agent isolation — 2-second VM startup
- Ephemeral by design — complete filesystem deletion after session end
- Immutable audit log of all access events with session replay
NHI Investment Landscape — The Market in Numbers
Aggregating just the major NHI-related funding rounds of the past year surpasses $340M. Add Palo Alto's $25B acquisition of CyberArk, and it becomes undeniable that identity security has become the central pillar of enterprise platform strategy.
| Company | Round | Amount | Date |
|---|---|---|---|
| Oasis Security | Series B | $120M | Mar 2026 |
| Akeyless | Series B | $65M | — |
| GitGuardian | Series C | $50M | 2026 |
| Astrix Security | Series B | $45M | 2025 |
| Aembit | Cumulative | $45M | — |
| Truffle Security | Series B | $25M | Nov 2025 |
| Clutch Security | Series A | $20M | Jan 2025 |
| Token Security | Series A | $20M | Jan 2025 |
NHI Vendor Landscape
Three approaches converging into unified NHI lifecycle management
Shift-Left
Detect before secrets leak
Vault
Centralize and dynamically issue
Threat-Based
Discover, monitor, and govern
RSAC 2026 made clear: these three approaches are converging into a unified NHI lifecycle — from secret detection to centralized management to enterprise-wide governance.
Agentic AI — The Catalyst Accelerating the NHI Problem
If RSAC 2026 can be summarized in one phrase, it is 'Everyone trying to secure AI agents' (Constellation Research). Approximately 40% of all sessions were AI-related, and the conference was structured around a dual challenge: using AI to improve security, and securing AI itself.
AI agents projected to be operational by 2028, each requiring human-equivalent governance.
IDC Forecast
Agentic AI is not a separate topic from NHI — it is the catalyst that is accelerating the NHI problem exponentially. Every AI agent is a new non-human identity.
MCP (Model Context Protocol) security made a sudden leap from theory to production concern this year. RSAC organizers noted that a significant portion of submitted papers were MCP-related. In one session, a complete Azure tenant takeover via MCP vulnerability and remote code execution was demonstrated live. A SANS session on the Five Most Dangerous New Attack Techniques noted that AI has eliminated the barriers to zero-day discovery, with zero-days findable at an AI token cost of $1.16M.
The most visible phenomenon at RSAC 2026 was every major vendor simultaneously launching Agentic AI security products: Cisco DefenseClaw (open source), Microsoft Entra Agent ID and Agent 365, Google Cloud Agentic Security Operations, CrowdStrike Falcon AI Security, and Palo Alto Prisma AIRS 3.0 all made their debuts.
Cisco DefenseClaw
An open-source agent security framework published to GitHub on March 27. It consists of five independent components — Skills Scanner, MCP Scanner, AI BoM, CodeGuard, and A2A Scanner — and operates across three protection layers: pre-installation scanning, runtime content scanning for all messages in and out of the agent execution loop, and block/allowlist enforcement including sandbox permission revocation within 2 seconds.
Microsoft Entra Agent ID & Agent 365
The foundational system for assigning unique identities to AI agents. Using Federated Identity Credentials, agent identities themselves hold no credentials — authentication flows through a multi-step token exchange and delegation architecture. Agent 365 (GA May 1), bundled with Microsoft 365 E7, provides agent activity visibility, Conditional Access expansion to AI agents, and shadow AI detection.
Google Cloud Agentic Security Operations
A Gemini-powered agentic SOC. The Triage and Investigation Agent autonomously investigates alerts, enriches findings with Google/Mandiant threat intelligence, decodes obfuscated commands, and delivers a verdict with comprehensive evidence. Gemini autonomously analyzes millions of external events daily at 98% accuracy. MCP server support reaches general availability in early April.
CrowdStrike Falcon AI Security
The product embodiment of CrowdStrike's strategic claim that 'AI security is a runtime control problem, and the endpoint is the center of it.' Falcon AI Runtime Protection captures commands, scripts, file activity, and network connections from all applications — including agentic apps — on the endpoint. Shadow AI Discovery for Endpoint auto-discovers AI apps, agents, LLM runtimes, MCP servers, and development tools across the entire endpoint fleet.
Palo Alto Prisma AIRS 3.0
Full lifecycle security for autonomous AI agents. Composed of Discovery (instant inventory of agents, models, and connections across cloud, SaaS, and endpoints), Assessment (Agent Artifact Security plus AI Red Teaming), and Protection via AI Agent Gateway — a central control plane for agent runtime security, identity, governance, and observability that handles structured agent communication at low latency to avoid bottlenecks in multi-agent workflows.
Start Securing Your Non-Human Identities Today
Community — BSidesSF & Cloud Village
Every late March, San Francisco becomes the center of the security industry's largest week — 'RSA Week.' BSidesSF (March 21-22) flows directly into RSAC (March 23-26), with two entirely different security cultures unfolding in the same city.
RSAC is the enterprise stage: 43,000+ attendees, 600+ exhibitors, All Access badges at $2,000+, with Hugh Jackman and four former NSA Directors on the keynote stage. BSidesSF is the grassroots counterpart: 2,965 attendees, $100-110 registration, 100% volunteer-run — and held within walking distance of Moscone Center at City View at Metreon.
While RSAC's main track is a keynote-and-panel enterprise showcase, the Villages are the hacker community's live operational space inside that larger event. RSAC 2026 ran seven Villages: AI Village, Adversary Village, AppSec Village, Cloud Village, ICS Village, IoT Village, and Physical Security Village.
Cloud Village is a nonprofit cloud security community that runs year-round at DEF CON (5+ years), RSAC, BSidesSF, and DEF CON Bahrain. At RSAC 2026, it operated in Moscone South Level 2 Room 204 and ran a three-day consecutive Jeopardy-style CTF with challenges across real AWS, GCP, and Azure environments using dynamic scoring.
The keynote tone of RSAC 2026 was set by Jen Easterly, former CISA Director and the conference's new CEO as of January 2026. The highlight session was four former NSA Directors — Keith Alexander, Tim Haugh, Paul Nakasone, and Mike Rogers — sharing a single stage to discuss 'Inside Offensive Cyber.'
Cremit CTF Results — 3rd at BSidesSF, 2nd at RSAC
Cremit placed 3rd at the BSidesSF 2026 Cloud Village CTF and 2nd at the RSAC 2026 Cloud Village CTF.
Presence on a vendor booth floor is a function of marketing budget and sales force. Placing in a Village CTF is a function of pure technical capability. Competitors must find vulnerabilities, escalate privileges, and exfiltrate data across real cloud environments — under time pressure, with no shortcuts.
Secrets leakage and NHI security are directly tied to the real-world threats that define cloud attack surfaces. A team that builds secrets detection tooling finishing at the top of a cloud CTF is the most direct evidence that the product is built on genuine, first-hand understanding of how these attacks actually work.
CISO Action Items
What to do after reading this report
Inventory your NHIs
Do you know how many service accounts, API keys, and AI agents operate in your environment? Most organizations don't. Start with a complete inventory.
Audit secret sprawl
Scan repositories, CI/CD pipelines, collaboration tools (Slack, Jira), and .env files for hardcoded credentials. 64% of leaked secrets remain valid for years.
Establish AI agent governance
Define policies for AI agent identity, access scope, and human oversight. 68% of organizations can't distinguish AI agent activity from human activity.
Automate secret rotation
Move from static, long-lived credentials to short-lived, dynamically issued tokens. Manual rotation doesn't scale with 100:1 NHI-to-human ratios.
Assess MCP security posture
If your teams use MCP-connected AI tools (Cursor, Claude, Copilot), audit which MCP servers are connected, what credentials they access, and who approved them.
Map NHI ownership
Every non-human identity needs a human owner. When an employee offboards, their service accounts and API keys must be identified and rotated.
Conclusion: Where NHI and Community Converge
RSAC 2026 showed that the cybersecurity industry has reached one consensus: Agentic AI governance is urgent, and it is not yet solved. TechRepublic summarized it as 'The industry has agreed on the problem — now the hard part begins.'
First, identity is becoming the universal control plane. Managing humans, machines, and AI agents within a single identity framework is the new standard. Ephemeral credentials and JIT access are replacing persistent access, and hardware-based authentication is extending to AI agents.
Second, MCP security is the new battleground. As Model Context Protocol emerges as the standard interface for agentic AI, MCP server scanning, Tool Poisoning defense, and MCP policy enforcement have made the leap from theory to production concern in a single year.
Third, secrets leakage, NHI, and Agentic AI are converging into a single problem. The three approaches — Shift-Left (secrets detection), Vault (secrets management), and Threat-based (NHI governance) — are converging into unified NHI lifecycle management.
Above all of this sits the community. Where a $25B acquisition and a $120M funding round reveal the direction of the market, a CTF ranking and 600 BSidesSF CFP submissions reveal the density and intensity of the technical community that actually drives this industry forward. Cremit placing 3rd at BSidesSF and 2nd at RSAC back-to-back is simply the fact: the team building secrets detection tooling is competing directly in the live, real-world cloud attack-and-defense arena.