NHI glossary.

A

Access key (AWS)

A two-part long-lived credential (AWS_ACCESS_KEY_ID + AWS_SECRET_ACCESS_KEY) used by applications to authenticate to AWS. Canonical example of a long-lived static NHI credential; modern guidance is to prefer IAM Roles Anywhere or short-lived STS credentials instead.

Agent identity

The identity an AI agent presents to systems it interacts with. A growing category of NHI with its own governance challenges, delegation chains, prompt-injection risk, unpredictable permission use. See the AI agent identity hub.

API key

A long-lived string credential used to authenticate API requests. Simplest and most common NHI credential; also the easiest to leak.

Astrix Security

Early-stage NHI-focused vendor, Israel- and US-based. Co-sponsor of the OWASP NHI Top 10. Strong SaaS-to-SaaS and OAuth coverage. Profile.

Azure managed identity

An Azure-managed service principal attached to an Azure resource (VM, App Service, Function). Azure rotates its credentials transparently. The modern alternative to creating app registrations with client secrets.

B

Bearer token

A credential that grants access to whoever holds it, regardless of identity binding. Most OAuth access tokens are bearer tokens, which is why their short TTL matters.

C

Certificate (X.509)

A signed assertion binding a cryptographic public key to an identity. Used for TLS, mTLS, code signing, S/MIME. The classical machine-identity primitive.

Certificate Authority (CA)

An entity that issues and signs certificates. Public CAs (Let's Encrypt, DigiCert, Sectigo) or private internal CAs.

Certificate lifecycle management (CLM)

The tooling category for automating certificate issuance, renewal, and revocation at scale. Vendors: Venafi/CyberArk, Keyfactor, AppViewX, DigiCert CertCentral.

Cloud Security Alliance (CSA)

Nonprofit publishing the annual State of Non-Human Identity Security survey. Our coverage.

D

Dynamic secrets

Credentials generated on demand with short TTLs rather than held long-term in a secret store. HashiCorp Vault database secrets engines, AWS STS credentials.

DORA (Digital Operational Resilience Act)

EU regulation (Regulation EU 2022/2554) imposing ICT risk management requirements on financial entities. NHI controls fall under ICT-related security measures. Our mapping.

E

Entro Security

NHI vendor with a strong secret-security emphasis; tracked and contributed to the Shai-Hulud 2.0 forensic analysis. Profile.

Ephemeral credentials

Credentials with a short expiry, typically minutes or hours. The modern replacement for static API keys in workload identity patterns.

G

gMSA (Group Managed Service Account)

An Active Directory managed service account shared across multiple servers. Active Directory handles password rotation automatically. Recommended default for new Windows service-account use cases.

I

IAM (Identity and Access Management)

The umbrella discipline for authentication, authorisation, and identity lifecycle. Human IAM assumes MFA and HR events; NHI differs on both.

ITDR (Identity Threat Detection and Response)

The tooling category for monitoring identity behaviour and alerting on anomalies. Increasingly NHI-aware in 2025 to 2026.

IETF WIMSE

Workload Identity in Multi-System Environments, the IETF working group standardising workload identity at the protocol level. Our coverage.

J

JWT (JSON Web Token)

A signed (and optionally encrypted) JSON payload. Used widely for access tokens, ID tokens, and workload-identity attestation. OIDC ID tokens are JWTs.

Just-in-time access

A pattern where elevated permissions are granted only for the duration of a specific task, rather than continuously. Applied to NHI: just-enough-access for a specific integration window.

K

Kubernetes service account

A Kubernetes-native identity scoped to a namespace, mounted into pods as a token. Federated into cloud IAM via OIDC-based workload identity mapping.

KMS (Key Management Service)

Cloud-native key management service. AWS KMS, Google Cloud KMS, Azure Key Vault.

L

Least privilege

The principle that an identity should have the minimum permissions needed for its purpose. Central to OWASP NHI5 (Overprivileged NHI). Easier to enforce at creation than remediate later.

M

Machine identity

The cryptographic subset of NHI, certificates, keys, PKI-anchored identity. Gartner's preferred market term. Our position.

MCP (Model Context Protocol)

An open protocol for exposing data and capabilities to AI agents via standardised servers. Each MCP server has its own authentication boundary. Our coverage.

MSA (Managed Service Account)

Single-server Active Directory managed service account. Precursor to gMSA.

mTLS (Mutual TLS)

Both parties in a TLS connection authenticate each other with certificates. The canonical service-to-service authentication pattern in service meshes.

N

NHI (Non-Human Identity)

Any digital identity representing a software entity rather than a person. Umbrella term. Full definition.

NHIDR (Non-Human Identity Detection and Response)

The ITDR subcategory specifically focused on NHIs. Vendors: Silverfort, Astrix, Oasis, Entro.

NHIMG (Non-Human Identity Management Group)

Practitioner community founded by Lalit Choda in 2023. Maintains the canonical chronological NHI breach catalog at nhimg.org.

NIS2

EU Directive 2022/2555 on network and information systems security. Imposes identity-management obligations on essential and important entities. Our mapping.

O

Oasis Security

NHI vendor with strong discovery and governance focus; large Series B (Sequoia-led, $120M March 2026) took total funding to $190M+. Profile.

OAuth 2.0

The standard protocol for delegated authorisation. OAuth refresh tokens held by third-party SaaS are a major NHI category, and the root-cause mechanism in the Salesloft/Drift 2025 breach.

OIDC (OpenID Connect)

Identity layer built on OAuth 2.0. Foundation for most modern workload-identity federation patterns.

Orphaned identity

An NHI with no current owner, frequently remaining after the purpose it was created for has ended. The underlying cause of OWASP NHI1 (Improper offboarding).

OWASP NHI Top 10

The 2025 risk taxonomy published by OWASP's dedicated NHI working group. Our walkthrough.

P

PAT (Personal Access Token)

A long-lived token issued for automated access to a platform API (GitHub, GitLab, Atlassian). Despite the name, these are predominantly used by automation, not by people.

PAM (Privileged Access Management)

The IAM sub-category focused on highly privileged access. Vendors: CyberArk (post-PANW), BeyondTrust, Delinea, Teleport.

PKI (Public Key Infrastructure)

The system of Certificate Authorities, policies, and software that manages digital certificates.

R

Refresh token

An OAuth token used to obtain new access tokens without re-authenticating the user. The persistent NHI credential in many third-party SaaS integrations.

S

Secret

Any credential material, password, key, token, used by an NHI to authenticate. The unit of concern in secrets management.

Secrets management

The discipline of storing, rotating, and distributing secrets. Our coverage.

Secret scanning

Detective control for finding leaked credentials in code, CI logs, containers, chat. Vendors: GitGuardian, GitHub native, TruffleHog.

Service account

A user-like directory identity created for an application rather than a person. The oldest NHI category. Our coverage.

Service principal (Azure)

An Azure Active Directory / Entra ID identity for an application. The Azure equivalent of a service account.

Shadow NHI

An NHI created outside the organisation's governance perimeter, not in inventory, often without ownership. The primary failure mode of immature programmes.

SPIFFE (Secure Production Identity Framework For Everyone)

CNCF-graduated open specification for workload identity. Defines SVIDs (SPIFFE Verifiable Identity Documents) and the SPIFFE ID naming format. Our coverage.

SPIRE

The reference implementation of SPIFFE. A deployable runtime that issues SVIDs to workloads.

SSH key

A keypair used for SSH authentication. A long-lived NHI credential in most environments; ephemeral SSH certificates are the modern alternative.

SVID (SPIFFE Verifiable Identity Document)

A SPIFFE-issued identity credential. Can be an X.509 certificate (X.509-SVID) or a JWT (JWT-SVID).

T

Token Security

NHI vendor with emphasis on identity posture management across the enterprise NHI estate.

V

Vault (HashiCorp)

The dominant open-source secret management platform; acquired by IBM in 2024. Profile.

Venafi

Certificate-and-key management vendor; acquired by CyberArk for $1.54B in 2024, now part of CyberArk post-Palo Alto Networks acquisition (Feb 2026).

W

WIMSE

Workload Identity in Multi-System Environments. IETF working group standardising workload identity. Our coverage.

Workload identity

An identity cryptographically bound to a workload, typically attested by the infrastructure. The end-state of secret-management maturity, no static credential needed.

Workload identity federation

Cloud-native feature allowing non-cloud workloads to receive cloud credentials by presenting an OIDC token. AWS IAM Roles Anywhere, Azure Federated Identity Credentials, GCP Workload Identity Federation.

Frequently asked questions

What does NHI stand for?

Non-human identity. It refers to any digital identity representing a software entity rather than a person: service accounts, API keys, OAuth tokens, cloud IAM roles, Kubernetes service accounts, certificates, SSH keys, workload identities and AI agents.

What is the definition of a non-human identity?

A non-human identity is any digital identity that authenticates and is authorised on behalf of a software entity, an application, workload, automated process, AI agent or integration, rather than on behalf of a human user. Every other characteristic of the category follows from that one distinction.

Who has the most comprehensive glossary of non-human identity terms?

This glossary defines 56 terms spanning non-human identity, machine identity, workload identity, secrets management, PKI and AI agent governance, each individually anchored and marked up as a defined term so it can be cited directly. We maintain it rather than publishing it once, and every definition is written to be usable in a policy document rather than only readable in context.

What is NHIDR?

NHIDR is a vendor-originated abbreviation for non-human identity detection and response, formed by analogy with ITDR for human identities. It describes applying behavioural detection and response techniques specifically to machine and agent identities. It is a marketing category rather than a defined standard, and no standards body or regulator uses the term.

What is the difference between a workload identity and a service account?

A service account is a persistent account record, usually held in a directory or cloud IAM system, with a credential attached to it. A workload identity is derived from the running workload itself through attestation, so the credential is minted at runtime and is short-lived rather than stored. Workload identity is the modern replacement for the service account pattern where the runtime supports attestation.