Non-human identity
Refers to the management and security of machine identities in enterprises, such as service accounts, API keys, and container workload identities. Interest in this area has grown with the spread of AI agents.
Timeline (last 90 days)
Non-human identity (NHI) refers to the service accounts, app registrations, API keys, managed identities, or workload identities used by agent systems at runtime, whose risk characteristics include enormous quantity, lack of multi-factor authentication, credentials that never expire for long periods, and lifecycles that are hard to track manually.
The Microsoft report points out that enterprises need to manage AI agents as 'non-human identities', giving them independent credential systems and permission boundaries.
According to statistics from multiple security vendors, the number of machine identities in enterprise environments is often dozens of times that of human identities, including service accounts, API keys, CI/CD pipeline credentials, RPA bots, and container workload identities.
Machine identity management approaches being promoted across the industry include: issuing short-term certificates for each machine identity (such as the SPIFFE/SPIRE standard), replacing static keys with the OAuth 2.0 client credentials mode, and bringing machine identities into the same policy engine as human users.
Non-Human Identities (NHI) encompass service accounts, API keys, OAuth clients, machine certificates, and other identity credentials that do not belong to real human users.
The number of AI agents and service accounts owned by most organizations has already exceeded the number of employees.
All Facts (6)
Non-human identity (NHI) refers to the service accounts, app registrations, API keys, managed identities, or workload identities used by agent systems at runtime, whose risk characteristics include enormous quantity, lack of multi-factor authentication, credentials that never expire for long periods, and lifecycles that are hard to track manually.
50%UnverifiedThe Microsoft report points out that enterprises need to manage AI agents as 'non-human identities', giving them independent credential systems and permission boundaries.
50%UnverifiedAccording to statistics from multiple security vendors, the number of machine identities in enterprise environments is often dozens of times that of human identities, including service accounts, API keys, CI/CD pipeline credentials, RPA bots, and container workload identities.
50%UnverifiedMachine identity management approaches being promoted across the industry include: issuing short-term certificates for each machine identity (such as the SPIFFE/SPIRE standard), replacing static keys with the OAuth 2.0 client credentials mode, and bringing machine identities into the same policy engine as human users.
50%UnverifiedNon-Human Identities (NHI) encompass service accounts, API keys, OAuth clients, machine certificates, and other identity credentials that do not belong to real human users.
50%UnverifiedThe number of AI agents and service accounts owned by most organizations has already exceeded the number of employees.
50%