What Is a Non-Human Identity (NHI)? NHI Management Explained

A non-human identity (NHI) is any identity that is not a person: service accounts, API keys, OAuth apps and tokens, certificates, workloads, bots and increasingly AI agents. NHI management is the work of finding them, giving each one an owner, scoping and shortening its credentials, and retiring it when its job ends. In most organizations NHIs outnumber human identities many times over, and they are widely under-governed.

Why NHIs are a growing risk

NHIs often have broad, standing privileges, no MFA, and credentials that rarely rotate. SWI's Identity Breach Report 2026 counts a non-human identity as the abused identity in 31 of 123 identity breaches disclosed from 2021 to November 2026 (25.2%), rising from 5 of 33 in 2021-2022 to 16 of 50 in 2025-2026. Exposed secrets, stolen credentials and software supply chain compromises started most of them.

Types of non-human identity

Failure modes, with real incidents

• Service accounts without MFA. In a July to August 2026 campaign tracked by Proofpoint, password spraying across 28 Chilean Microsoft 365 tenants compromised seven accounts, all functional or service accounts with no MFA on default or never-rotated passwords (password spraying).
• Stolen OAuth tokens for a SaaS integration. In August 2025 UNC6395 used Salesloft Drift OAuth tokens to export data from many Salesforce tenants, then searched it for AWS keys and Snowflake tokens (refresh token abuse).
• Credentials not rotated after a known breach. Cloudflare's 2023 intrusion used one access token and three service account credentials taken in the Okta support breach that it had failed to rotate.
• A vendor's API key. The US Treasury intrusion ran through a stolen BeyondTrust Remote Support key (static API key abuse).
• Privileged automation accounts. At Dropbox Sign, a compromised service account in a configuration tool had rights to act in production and reached the customer database.
• Legacy OAuth apps nobody owned. Midnight Blizzard sprayed a test tenant account, then used a legacy test OAuth application with elevated access to Microsoft's corporate tenant (orphaned account abuse).

Start with ownership, not discovery

The instinct is to buy a discovery tool, and the result is an inventory of thousands of identities that nobody acts on. The prerequisite is ownership: an identity with a named human accountable for it can be reviewed, scoped, rotated and eventually retired. One without an owner cannot be touched, because nobody will accept the risk of breaking it. Read the credentials nobody owns for five September 2026 disclosures that turned on exactly this.

A workable sequence:

1. Assign owners to the identities that can reach production or customer data. Unowned means scheduled for removal, and that deadline is what produces owners.
2. Set an expiry on every credential, even if the first expiry is a year out. An identity with no expiry never gets reviewed.
3. Scope down using usage data, which is the only evidence an owner will accept. In cloud estates this is what CIEM tools compute.
4. Replace static credentials with platform-attested workload identity wherever the runtime can vouch for the caller. See what is machine identity.
5. Vault what must stay static with secrets management, and revoke rather than delete any secret that reached a repository.
6. Put them in access reviews. If your quarterly certification does not list non-human identities, it is certifying a shrinking fraction of what can reach your data.

What AI agents change

Agents are non-human identities created faster than any review cycle, and they break two assumptions: there is no interactive login, and the agent acts for a user across several systems, so the audit question becomes a delegation chain rather than a single call. When that chain crosses into another organization, identity chaining is the IETF draft for carrying the user and the grant across the trust boundary. Watch for scope escalation through delegation and agent instruction injection.

Standards status as of November 2026: MCP authorization revision 2026-07-28 builds on the OAuth 2.1 draft (now at draft-17, with an IESG milestone of December 2026). The identity assertion authorization grant behind Okta's Cross App Access is at draft-06, an IETF working group document, while its MCP binding is the stable Enterprise-Managed Authorization extension. Microsoft documents Entra Agent ID as available to all Entra customers, with agent identity blueprints as templates. That gives agents short-lived, revocable, identity-provider-issued tokens instead of static API keys.

The governance did not move as fast. Okta's Agent SSO announcement says only 34 percent of organizations apply the same security controls to AI agents as to human workers. See agent identity just got a protocol and agentic identity.

The NHI vendor market in 2026

Most of the first wave of NHI specialists was bought this year:

• Astrix Security: acquired by Cisco (closed 29 June 2026); standalone sales of new licenses ended on 30 June 2026.
• Entro Security: acquired by SailPoint (closed 29 June 2026) for 122.6 million dollars in cash, feeding SailPoint's Agentic Fabric.
• Natoma: acquired by Snowflake (closed 3 June 2026) for 128.3 million dollars.
• Oasis Security: acquired by Cyera, completion reported 8 September 2026, for about 1 billion dollars.
• Permiso Security: acquired by Okta (closed 26 August 2026).

Still independent: Aembit, Clutch Security, Token Security and P0 Security. Pricing is mostly quoted: 11 of 14 agentic and AI identity vendors in SWI's pricing index are quote-only. Aembit lists 20 dollars per workload per month after 10 free workloads, and P0 shows a price only on AWS Marketplace.

Where to start

Read the non-human identity security guide, securing AI agent identities and the machine identity management guide. For tools, see the best non-human identity security platforms, best AI agent identity tools and best machine identity for enterprises, and compare Aembit vs Astrix and Astrix vs Entro.