Non-Human Identity (NHI)
Any identity that is not a person: service accounts, API keys, OAuth tokens, certificates, workloads, and AI agents. NHIs now outnumber human identities in most organizations and are frequently over-permissioned and under-governed.
The count is the headline (NHIs outnumber humans by a large multiple almost everywhere) but the governance gap is the actual problem: these identities are created by engineers during delivery, inherit whatever credential was nearest, have no owner, and appear in no access review. AI agents are making them faster. Start with ownership and expiry, not with a discovery tool that produces an unactionable inventory.
See also: what is non-human identity, service account, workload identity, machine identity vendors, MFA blind zone, fan-out breach, agent registry, machine identity
Related on Start with Identity
- GlossarySecrets Rotation
The practice of regularly changing credentials such as API keys, database passwords, and tokens to limit the window an exposed secret is useful. Dynamic secrets
- GlossaryInstance Metadata Service (IMDS)
The instance metadata service (IMDS) is an HTTP endpoint reachable only from inside a cloud virtual machine, at 169.254.169.254 on AWS EC2, that returns data ab
- GlossaryLLMjacking
LLMjacking is the use of stolen credentials to consume, resell, or abuse someone else's access to a large language model, usually through a cloud account or an
- GuideNon-Human Identity (NHI) Security: The 2026 Guide
Non-human identities now outnumber people many times over, and most are under-governed. A practical guide to what NHIs are, why they are the fastest-growing att
- RankingBest Non-Human Identity Security Platforms: Top 5
The best non-human identity (NHI) security platforms in 2026: Astrix Security, Token Security, Oasis Security, Entro Security, and Aembit. Ranked for discovery,
- TemplateService Account and Non-Human Identity Policy Template
A fill-in policy for service accounts, API keys, OAuth apps, workload identities and AI agents: ownership, approved credential types and maximum lifetimes, rota