Identity for Agents and NHIs: Transforming Secrets Management
Source: YouTube · SANS Cloud Security · published Aug 25, 2026 · 57:59
Nick Hunt argues agents should bootstrap ephemeral, cryptographically-bound identities (SPIFFE) and exchange them for narrowly-scoped tokens via policy—"stop managing credentials, start managing policy" 54:07-55:13.
Key Takeaways:
• NHI growth is explosive: 144 NHIs per human (up to 500:1), 400% machine identity growth 2021-2025, 29M leaked secrets, 81% jump in leaked AI credentials; Gartner predicts ~150K agents per Fortune 500 by 2028 6:19-9:20
• Static provisioning doesn't scale—150K agents means rotating credentials every ~17 seconds, multiplying failure points in creation, execution, and cleanup 14:59-15:18
• Authentication is largely solved (SPIFFE/SPIRE, workload identity federation at AWS, Microsoft, OpenAI, Anthropic); authorization is the harder half, needing relational policy models (FGA, Cedar, OPA) 30:58-32:09
• Open-source "Draco" library collapses bootstrap, SPIFFE identity, dynamic client registration, policy retrieval, token exchange, and self-deregistration into one call—nothing left to replay 36:37-38:12
• Lessons: don't treat agents as users, plan trust boundaries across environments, bind tokens to the invoking user, and keep tokens micro-scoped and short-lived 21:40-27:23
A live demo shows the full lifecycle—bootstrap, SVID, OAuth client, tool execution, full deregistration—in ~30 seconds; adopt policy-driven, identity-exchange architectures before agent volumes overwhelm per-credential governance 48:08-57:10
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 1 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Identity & Access Management. Commonly maps to: Identity and Access Management (IAM), Security Architecture and Engineering. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
Hey, good afternoon, good morning, good evening to everyone. Um, my name is Nick Hunt. What I'm going to be talking about today is uh, essentially it's not a new way to think about identity for agents, but more looking at the market as we're going right now in the the hyper growth of NHIs, secrets management, agents, right? And maybe a different way to think about how to authenticate and specifically authorize those agents for possible secrets that it needs, um, but also the rest of your environment, right? You know, I've been doing this for a long time and you know, I want to kind of go through a couple of things I've been working on and different approaches to handle this. Um, but from an introduction, you know, really quite simple. Um, my name is Nick Hunt. Uh, I've been doing cyber sec…