Addressing non-human identities risk requires treating identity security as a data problem, not just an access problem.