Non-human identity
Refers to the management and security of machine identities in enterprises, such as service accounts, API keys, and container workload identities. Interest in this area has grown with the spread of AI agents.
Core Facts
Timeline (last 90 days)
Non-human identity (NHI) refers to identity entities such as service accounts, bots, API keys and workload identities that do not represent a specific natural person but access resources programmatically.
Non-human identity (NHI) refers to the service accounts, app registrations, API keys, managed identities, or workload identities used by agent systems at runtime, whose risk characteristics include enormous quantity, lack of multi-factor authentication, credentials that never expire for long periods, and lifecycles that are hard to track manually.
Machine identity management approaches being promoted across the industry include: issuing short-term certificates for each machine identity (such as the SPIFFE/SPIRE standard), replacing static keys with the OAuth 2.0 client credentials mode, and bringing machine identities into the same policy engine as human users.
According to statistics from multiple security vendors, the number of machine identities in enterprise environments is often dozens of times that of human identities, including service accounts, API keys, CI/CD pipeline credentials, RPA bots, and container workload identities.
The Microsoft report points out that enterprises need to manage AI agents as 'non-human identities', giving them independent credential systems and permission boundaries.
Non-Human Identities (NHI) encompass service accounts, API keys, OAuth clients, machine certificates, and other identity credentials that do not belong to real human users.
The number of AI agents and service accounts owned by most organizations has already exceeded the number of employees.
All Facts (7)
Non-human identity (NHI) refers to identity entities such as service accounts, bots, API keys and workload identities that do not represent a specific natural person but access resources programmatically.
65%UnverifiedNon-human identity (NHI) refers to the service accounts, app registrations, API keys, managed identities, or workload identities used by agent systems at runtime, whose risk characteristics include enormous quantity, lack of multi-factor authentication, credentials that never expire for long periods, and lifecycles that are hard to track manually.
50%UnverifiedMachine identity management approaches being promoted across the industry include: issuing short-term certificates for each machine identity (such as the SPIFFE/SPIRE standard), replacing static keys with the OAuth 2.0 client credentials mode, and bringing machine identities into the same policy engine as human users.
50%UnverifiedAccording to statistics from multiple security vendors, the number of machine identities in enterprise environments is often dozens of times that of human identities, including service accounts, API keys, CI/CD pipeline credentials, RPA bots, and container workload identities.
50%UnverifiedThe Microsoft report points out that enterprises need to manage AI agents as 'non-human identities', giving them independent credential systems and permission boundaries.
50%UnverifiedNon-Human Identities (NHI) encompass service accounts, API keys, OAuth clients, machine certificates, and other identity credentials that do not belong to real human users.
50%UnverifiedThe number of AI agents and service accounts owned by most organizations has already exceeded the number of employees.
50%