Non-Human Identity (NHI)
Any identity that is not a person: service accounts, API keys, OAuth tokens, certificates, workloads, and AI agents. NHIs now outnumber human identities in most organizations and are frequently over-permissioned and under-governed.
The count is the headline (NHIs outnumber humans by a large multiple almost everywhere) but the governance gap is the actual problem: these identities are created by engineers during delivery, inherit whatever credential was nearest, have no owner, and appear in no access review. AI agents are making them faster. Start with ownership and expiry, not with a discovery tool that produces an unactionable inventory.
See also: what is non-human identity, service account, workload identity, machine identity vendors
Related on Start with Identity
- GlossarySecrets Rotation
The practice of regularly changing credentials such as API keys, database passwords, and tokens to limit the window an exposed secret is useful. Dynamic secrets
- GlossaryInstance Metadata Service (IMDS)
The instance metadata service (IMDS) is an HTTP endpoint reachable only from inside a cloud virtual machine, at 169.254.169.254 on AWS EC2, that returns data ab
- GlossaryLLMjacking
LLMjacking is the use of stolen credentials to consume, resell, or abuse someone else's access to a large language model, usually through a cloud account or an
- GuideNon-Human Identity (NHI) Security: The 2026 Guide
Non-human identities now outnumber people many times over, and most are under-governed. A practical guide to what NHIs are, why they are the fastest-growing att
- RankingBest Non-Human Identity Security Platforms: Top 5
The best non-human identity (NHI) security platforms in 2026: Astrix Security, Token Security, Oasis Security, Entro Security, and Aembit. Ranked for discovery,
- ArticleThe Best Podcast Episodes on Non-Human and Agentic AI Identity
Twelve podcast episodes that explain non-human identity and AI agent identity well enough to act on: secrets sprawl, workload identity, SPIFFE, delegation, MCP