Theses›Software & applications›Non-human identity and secrets

Non-human identity and secrets

The keys software holds become the main way in, and the platforms that already own identity absorb the fix

  • Bear
  • Closing
  • $38B by 2035

The callThe demand side is winning: about 9 of 24 verified October 2026 incidents came through keys software holds, and spend grows above 20% a year. Incumbents bought four independents in three months, so the window is late.

D1D2D3R1R2R3C1C2foragainst D1D2D3R1R2R3C1C2foragainst
Fig. 1The balance. Drivers and catalysts against restraints, each block sized by its weight; catalysts hang dashed because they have not happened yet, sized by their odds. It tips toward the restraints.
  1. D1About 9 of 24 verified incidents in October 2026 came through stolen, reused or unrotated machine credentials, including secrets taken from hosting platforms and developer tokens behind poisoned software releases.
  2. D2AI agents multiply API keys, service accounts and tokens, and cheap AI-assisted attack means a leaked key gets used within hours.
  3. D3A buyer running AWS, Azure, GCP, GitHub and several model providers cannot get one place to issue and rotate machine credentials from any single vendor.
  4. R1The layer consolidated in 2026: Palo Alto closed CyberArk for about $25B in Feb, and between June and September Cisco, SailPoint and Okta each bought an independent while a fourth went for about $1B.
  5. R2AWS, Google, Azure and GitHub ship short-lived workload credentials free.
  6. R3The agent platforms, Microsoft Agent 365 among them, could ship their own credential brokers and close the cross-vendor slice.
  7. C1A mainstream framework (PCI DSS, SOC 2, an ISO 27001 annex or the EU Cyber Resilience Act standards) names automatic rotation or short-lived machine credentials as a required control.31 Dec 2027
  8. C2At least two of the three best-known remaining independents are bought by an identity, security or cloud incumbent.31 Dec 2027
Rests onthe beliefs underneath
Supported by · confidence
What would prove itdated tests, open and resolved
20272028today1234predictionswatch 20272028today1234predictionswatch
Fig. 2Each ring is a dated test: dashed while open, struck through when overdue, ticked or crossed once resolved.
  1. 1By 31 Dec 2027 at least two of Aembit, Token Security and Clutch Security are acquired by an identity, security or cloud incumbent.Dec 2027 · open
  2. 2By 31 Dec 2027 a mainstream control framework names automatic rotation or short-lived credentials for non-human identities as a required control.Dec 2027 · open
  3. 3EU Cyber Resilience Act conformity in Dec 2027, and whether PCI DSS or SOC 2 name automatic rotation as required.Dec 2027 · open
  4. 4Whether the agent platforms, Microsoft among them, ship their own credential brokers.Dec 2027 · open
Expressionslisted, private, technologies
What changedthe record, newest first
  • 23 Oct 2026The biggest cause of last month's breaches was keys that software holds, not people's passwords. It is a real and growing market, and the incumbents bought the startups before the rule that would force the spend has even arrived.