Non-human identity governance, from the sources.
Service accounts, workload identities and AI agents, and the keys and tokens that prove them, outnumber your people by a wide margin, and their credentials were at the centre of incidents such as Salesloft/Drift, Storm-0558, Codecov and Shai-Hulud. This site is a sourced reference for understanding and governing them.
Non-human identity (NHI) governance is the practice of knowing which non-human identities exist, who is accountable for each, what each may access, and being able to evidence all three. A non-human identity is an identity assigned to software, or to a device acting as a workload, and not to a person. How NHI governance works.
Free to read. No company pays to be profiled. HumanAudit is an interested party: see About.
New and recently updated
- NHI market consolidation tracker. Astrix to Cisco, Entro to SailPoint, Oasis to Cyera. All three were acquired during 2026. Reviewed on the schedule in the methodology.
- AI agent identity standards: the 2026 landscape, every active effort mapped with its real status, and what to build now.
- Certificate lifecycle and the 47-day deadline. TLS lifetimes fall to 47 days by March 2029. Why this is an NHI problem.
- Agentic Trust Framework. An open specification applying Zero Trust to autonomous agents, introduced on the Cloud Security Alliance blog, and its limits.
- NHI vendor comparison. Current ownership and the nine questions that discriminate.
- NHI and AI agent standards tracker, every standard, draft and regulation with its real status. Including what does not exist yet.
- ISO/IEC 42001 × NHI. Clause by clause, and the five ways non-human identity breaks the audit.
- Guides by role, for CISOs, internal auditors, and identity architects.
Latest news analysis
What changed, why it matters, who is affected, what to watch.
- Keyfactor closes its Summit Partners investment and adds former CyberArk CEO Matt Cohen to the board
. Keyfactor said its investment round of more than $1 billion led by Summit Partners has closed, and named Matt Cohen as a director and strategic adviser.
- IETF WIMSE working group posts a first draft on identity for AI systems
. A working group draft titled AI Identity Management System was posted at version 00. It is an early draft, not a standard.
- Cyera completes its acquisition of Oasis Security, which becomes Cyera Identity
. Cyera said the deal has closed, valued it at $1 billion, and renamed the platform Cyera Identity.
- CrowdStrike announces an identity provider for AI agents, with no availability date
. The Agentic Identity Provider was announced at Fal.Con 2026. The announcement did not state when it will be generally available.
The identities nobody is watching.
Service accounts, workload identities and AI agents, and the keys, tokens and OAuth grants they use, outnumber your people by a wide margin, and the joiner-mover-leaver process that governs everyone else was not built for them.
Three sections
Every page either teaches a concept, translates a framework, or dissects a breach. No vendor paywalls and no paid placement.
The reference library
Definitions, lifecycle and glossary pages, with sources. What is a non-human identity? What distinguishes it from machine identity and workload identity? How does the lifecycle work? A-Z glossary.
Browse the library →The framework translator
OWASP NHI Top 10 with a working self-audit. SPIFFE and SPIRE explained without the vendor spin. The IETF WIMSE working group's draft architecture, read and summarised. The CSA 2024 non-human identity survey. NIS2, DORA, and EU AI Act cross-mapped to NHI controls.
See the frameworks →The breach catalog
Six NHI breach case studies, broken down to the attack chain, the NHI root cause as we read it, the timeline, and the controls that address it. Salesloft/Drift. Snowflake. Microsoft Storm-0558. Shai-Hulud 2.0. Okta Support. Codecov. Fewer cases, more depth.
Study the breaches →Four ways in, all free.
No signup. Nothing is emailed and nothing is stored.
Where the market is moving next.
Two areas that are changing fastest: identity for AI agents, and the companies that sell non-human identity products.
Identity for AI agents, MCP servers, and agentic workloads.
Microsoft Entra Agent ID. SailPoint Agent Identity Security. Model Context Protocol governance. Delegation patterns. Human-in-the-loop controls.
Enter the hub →Company records
Sourced records for 146 companies, without paid placement, with an evidence label on every fact and a verification date on every profile. Compare direct competitors side by side.
Open the vendor hub →Why this site takes no vendor money.
This site takes no money from the companies it covers. The site is published by HumanAudit Inc., which sells ISO/IEC 42001 documentation and plans NHI governance documentation packs, not NHI tools (see About). We take no vendor money.
Reading is one thing. Evidence is another.
This reference is published by HumanAudit Inc., which builds the artefacts a compliance team attaches to an audit file. If you have moved past understanding the problem and need documentation that survives an assessor tracing a control, that is the work we do.
NHI governance packs
Policy, ownership register, lifecycle procedures and an RFP kit for machine and agent identities. Planned, not yet on sale; no prices yet.
See what they will contain → On saleAI Management System Library
HumanAudit's documentation library for an ISO/IEC 42001 AI management system. On sale now.
See the library → Talk to the editorBook a 20-minute call
Ask about the planned packs, or tell us what your auditors are asking about machine identities.
Pick a time →Frequently asked
What is non-human identity?
A non-human identity is an identity assigned to software, or to a device acting as a workload, and not to a person: service accounts, service principals, cloud roles, workload identities and AI agent identities. API keys, tokens and certificates are the credentials that prove them. Full definition here.
Is this the same as machine identity management?
Partially. "Machine identity" (the framing used by Gartner and certificate-lifecycle vendors) centres on the machine or certificate as the identity-bearing unit. "Non-human identity" (NHIMG, OWASP and a number of newer vendors) is a broader umbrella that includes SaaS-to-SaaS connections, OAuth apps, and AI agents. We use NHI as the umbrella term and break down the distinction here.
Who publishes this site?
HumanAudit Inc., a Delaware C-Corp. We also publish euaiactchecklist.com and iso42001toolkit.com, which are commercial documentation products. No company pays to be profiled. HumanAudit plans paid NHI governance documentation packs, so it has a commercial interest in this market. More on who we are.
Do vendors pay to appear here?
No. No vendor pays to be profiled, reviewed, compared, or mentioned on any content page. We carry no affiliate links of any kind. No company pays for inclusion, placement or wording. If a profiled company becomes a HumanAudit customer, its profile will say so. Editorial policy in full.
Is this legal advice?
No. Everything on this site is educational and informational. For compliance decisions affecting your organisation under NIS2, DORA, HIPAA, PCI DSS, or the EU AI Act, consult qualified legal counsel. See the Terms of Use.