In a move that signals the "Industrialization of AI Security," Oasis Security has officially closed a $120 million Series C funding round. The round, led by...
What NHI Management Actually Covers
Non-human identities (NHIs) are the service accounts, API keys, tokens, certificates, and machine credentials that software uses to talk to other software. In most organizations they already outnumber human accounts, and each one is a standing grant of access that rarely gets reviewed after it is created. NHI management is the practice of discovering these identities, understanding what they can reach, and controlling their lifecycle the same way you would for an employee who joins, changes roles, and eventually leaves.
The reason Oasis Security's $120 million Series C is worth noting is not the number itself but what it says about demand: enterprises are treating machine identity as a first-class security problem rather than a byproduct of individual application deployments. That shift is what the "Industrialization of AI Security" framing points to — moving from ad hoc credential handling toward repeatable, auditable processes.
Why AI Workloads Make This Urgent
Every AI agent, retrieval pipeline, and model-serving job needs credentials to fetch data, call other services, and write results. These workloads spin up and tear down quickly, and they often request broad access because narrowing permissions takes engineering time that teams under deadline pressure skip. The result is a growing pool of powerful, long-lived, poorly-tracked credentials — exactly the kind of target attackers prefer, because a leaked key works silently and does not trigger the login anomalies that catch stolen human passwords.
As automated systems generate and consume more of these identities, manual tracking stops scaling. That is the practical gap a dedicated NHI platform aims to close.
Practical Steps Teams Can Take Now
You do not need a funding announcement to start improving NHI hygiene. The work breaks down into a few concrete moves that pay off regardless of which tools you eventually adopt:
- Inventory first: enumerate every service account, key, and token across your environments, including ones created outside the central identity system.
- Map access: record what each identity can actually reach, not just what it was intended to reach.
- Rotate and expire: give credentials a defined lifetime and automate rotation so a single leak has a short useful window.
- Scope down: replace broad grants with least-privilege permissions tied to the specific job the identity performs.
- Assign ownership: every NHI should trace back to a human or team accountable for its existence.
What to Watch as the Category Matures
Funding rounds like this one tend to pull more vendors into a space, which is good for choice but risky if you buy a tool before you understand your own environment. The most useful thing an NHI platform does is give you visibility and enforce lifecycle rules; if you cannot answer "how many machine identities do we have and what can they do" today, that question is the right place to spend effort first.
Judge any solution by whether it reduces the number of forgotten, over-permissioned credentials and shortens the time between a leak and its containment. Those outcomes are measurable, and they matter more than the size of any single investment in the field.