Condensed primer

NHI security, the 1,500-word primer.

A tight introduction for readers who want the core ideas before committing to the full pillar. Share-with-the-team length. For the complete treatment, the longer NHI security pillar page is the right read.

By HumanAudit Inc. editorial teamLast reviewed 5 August 2026
VerifiedLast reviewed 5 August 2026 by the HumanAudit Inc. editorial team.Corrections logEditorial policy
On this page
  1. What NHI security is
  2. Why it moved from edge concern to top priority
  3. The three attack patterns that dominate
  4. The OWASP NHI Top 10, 30-second summary
  5. The seven controls that move the needle
  6. Why traditional IAM doesn't cover this
  7. Where to go next
  8. Frequently asked questions
  9. What transfers from human identity security,…

TL;DR

  • The controls that protect people do not transfer. MFA, session timeout and joiner-mover-leaver all assume a human is present. None of them applies to a credential in a config file.
  • Secrets leak from more places than code. Repositories, CI logs, container images, chat, and increasingly context supplied to AI models.
  • Over-privilege is the multiplier. A leaked credential is a minor incident or a breach depending entirely on what it was allowed to reach.
  • Detection assumes a baseline. Machine behaviour is regular, which makes anomalies easier to spot than for humans, and almost nobody models it.

What NHI security is

NHI security is the practice of protecting the digital identities used by software, service accounts, API keys, OAuth tokens, cloud IAM roles, Kubernetes service accounts, certificates, SSH keys, workload identities, and AI agents, from compromise, misuse, over-privileging, and orphaning. It is adjacent to but distinct from classical identity and access management (IAM), which was designed for human users.

Why it moved from edge concern to top priority

In 2023 to 2025, non-human identities became the leading root cause of enterprise breach. Salesloft/Drift (2025, 700+ orgs). Snowflake UNC5537 (2024, 165 customers). Microsoft Storm-0558 (2023, 60,000 US State Department emails). Shai-Hulud 2.0 (2025, credentials from ~25,000 repositories across ~1,195 organisations (Entro Security)). In every case, the initial access vector was an NHI credential, not a phished user, not a zero-day, not a perimeter-appliance vulnerability.

Meanwhile, NHIs have scaled faster than humans. The commonly-cited ratio is 45-to-1, 45 non-human identities for every human user, on average, in the enterprise. Cloud-native, SaaS-heavy, and AI-enabled organisations run higher ratios still. The defender's surface area has grown faster than the defender's tooling.

The three attack patterns that dominate

Real-world NHI breaches cluster into three patterns. If you are doing a quick risk scan, these are what you are looking for:

  1. Leaked static credentials. An API key, service-account password, or long-lived token ends up somewhere an attacker can reach, public GitHub, a container image, a developer laptop, a breached SaaS. The credential has no MFA and no short expiry, so the attacker uses it freely. Codecov, Shai-Hulud.
  2. Orphaned identities. An NHI is created for a purpose, the purpose ends, the identity keeps living. Years later it is still valid, still privileged, and nobody knows it exists. Microsoft Storm-0558 used a 2016-issued signing key in 2023.
  3. Over-privileged NHIs used for lateral movement. A narrowly-needed NHI is granted broad permissions for convenience. When compromised, the attacker inherits those permissions and can pivot. Snowflake UNC5537 exploited broad customer-side permissions harvested via infostealers.

The OWASP NHI Top 10, 30-second summary

The 2025 OWASP Non-Human Identities Top 10 is the most useful shared taxonomy the field has. The ten risks:

NHI1, Improper offboarding. NHI2, Secret leakage. NHI3, Vulnerable third-party NHI. NHI4, Insecure authentication. NHI5, Overprivileged NHI. NHI6, Insecure cloud deployment. NHI7, Long-lived secrets. NHI8, Environment isolation. NHI9, NHI reuse. NHI10, Human use of NHI.

Full walkthrough and self-audit here.

The seven controls that move the needle

  1. Inventory. Automated, continuous, across all source systems. Foundation, nothing else works without it.
  2. Ownership. Every NHI has a current human owner. No orphans at creation.
  3. Credential rotation. Scheduled, automated. Where possible, short-lived or workload-bound instead of static.
  4. Least privilege. Permissions granted at minimum; drift detected; reviewed regularly.
  5. Lifecycle automation. Decommissioning tied to identifiable events (HR termination, application retirement, integration removal).
  6. Behavioural monitoring. NHIs baselined; anomalies alerted.
  7. Third-party integration governance. OAuth apps reviewed on install, re-reviewed on change, revoked on deprecation.

Why traditional IAM doesn't cover this

Human IAM assumes a second factor, a manager, a baseline population, and an HR event for offboarding. NHIs have none of those. Every IAM control that silently depends on one of these assumptions becomes ineffective in the NHI case, which is why mature human IAM programmes still produce the kinds of breaches in the breach catalog.

Where to go next

Frequently asked questions

What is NHI security?

NHI security is the protection of credentials belonging to software rather than people, and of everything those credentials can reach. It covers preventing exposure, limiting scope, detecting misuse and revoking access. It differs from human identity security mainly in what is unavailable: no multi-factor prompt, no user to notice anomalous behaviour, and no HR event to trigger offboarding.

Why should an enterprise with a large development team prioritise NHI security?

Because the number of non-human identities scales with engineering activity, not headcount. Every pipeline, integration, environment and service adds credentials, and each is created by an engineer solving an immediate problem rather than by a governed process. Organisations with substantial development teams therefore accumulate the largest NHI estates and the widest gap between identities created and identities tracked.

What are the main NHI security risks?

Four dominate in assessments: credentials with unbounded lifetime, permissions that exceed actual function, identities with no accountable owner, and third-party integrations whose scope was never reviewed. A fifth is emerging with agents: delegated authority that cannot be traced back to a person. Each maps to a category in the OWASP Non-Human Identities Top 10.

Is NHI security a subset of identity security?

Structurally yes, operationally not really. It sits within identity security but the tooling, primitives and lifecycle triggers are different enough that treating it as an extension of an existing IAM programme usually leaves gaps. Most organisations find that access-review concepts transfer, while provisioning, credential handling and offboarding need to be designed separately.

How do you measure NHI security posture?

Score four dimensions separately rather than producing one composite: discovery coverage, ownership attribution, credential control, and evidence. Take the lowest rather than the average, because an organisation that knows a great deal but can demonstrate none of it will not pass an audit. Our maturity model sets this out in full.

What transfers from human identity security, and what does not

This is the distinction that determines whether an existing identity programme can absorb non-human identity or needs a separate one.

ControlTransfers?Why
Access review conceptYesThe idea of periodic recertification applies. The method does not: attestation fails when no manager knows what the identity does.
Least privilegeYesApplies directly, and is easier to measure than for humans because exercised permissions are observable.
Multi-factor authenticationNoThere is no second factor a workload can present that is not simply a second credential.
Joiner-mover-leaverNoNon-human identities generate no HR event. Nothing fires when their purpose ends.
Session timeoutNoMachine sessions are long-lived by design. Timeout breaks the workload rather than protecting it.
Behavioural detectionPartlyEasier in principle, because machine behaviour is regular. Rarely implemented, because the baseline is never modelled.

Where does your programme actually sit?

Reading about NHI governance and measuring your own position are different exercises. The free maturity assessment scores you across discovery, ownership, credential control and evidence in about ten minutes, in your browser, and produces a written report.

Run the maturity assessment →or book a 20-minute discovery call →