Non-Human Identity (NHI)
Any identity that is not a person: service accounts, API keys, OAuth tokens, certificates, workloads, and AI agents. NHIs now outnumber human identities in most organizations and are frequently over-permissioned and under-governed.
The count is the headline (NHIs outnumber humans by a large multiple almost everywhere) but the governance gap is the actual problem: these identities are created by engineers during delivery, inherit whatever credential was nearest, have no owner, and appear in no access review. AI agents are making them faster. Start with ownership and expiry, not with a discovery tool that produces an unactionable inventory.
See also: what is non-human identity, service account, workload identity, machine identity vendors
Related on Start with Identity
- GlossarySecrets Rotation
The practice of regularly changing credentials such as API keys, database passwords, and tokens to limit the window an exposed secret is useful. Dynamic secrets
- GlossaryAPI Key
A static secret string used to authenticate an application or caller to an API. Simple but weak: it does not expire on its own, is easy to leak, and should be v
- GlossaryBreak-Glass Account
A tightly controlled emergency account used only when normal access fails, with strong vaulting, monitoring, and alerting. Tested regularly so it works in a rea
- GuideNon-Human Identity (NHI) Security: The 2026 Guide
Non-human identities now outnumber people many times over, and most are under-governed. A practical guide to what NHIs are, why they are the fastest-growing att
- RankingBest Non-Human Identity Security Platforms: Top 5
The best non-human identity (NHI) security platforms in 2026: Astrix Security, Token Security, Oasis Security, Entro Security, and Aembit. Ranked for discovery,
- ArticleTop 6 Open-Source Secrets Scanning and Non-Human Identity Tools
The best open-source secrets scanning tools in 2026, from TruffleHog and Gitleaks to detect-secrets, git-secrets, Kingfisher, and NHI Hound, compared on validat