Non-Human Identities (NHI): The Complete 2026 Guide

What is a non-human identity (NHI)?

A non-human identity (NHI) is a digital credential that lets software authenticate and act without a person signing in. Service accounts, API keys, OAuth tokens, workload identities, machine certificates, and AI agents are all NHIs. They are how applications, cloud services, pipelines, scripts, and automated workflows prove who they are and get access to systems and data, and they operate largely outside the identity controls built for human users.

The category matters now because it has quietly become the majority of the identity estate. CyberArk’s 2025 Identity Security Landscape, a survey of 2,600 security decision-makers, puts the ratio at 82 machine identities for every human, and Entro Labs’ H1 2025 research found it climbing to 144 to 1, up from 92 to 1 a year earlier. Every one of those identities is an access path, yet most receive a fraction of the oversight a single employee account gets: according to the Cloud Security Alliance, only 20% of organizations have a formal process for revoking API keys.

Why non-human identities are the security problem of 2026

The risk is not theoretical, and the breach data makes that clear. Two-thirds of enterprises have already suffered a breach traced to a compromised non-human identity. The reason NHIs are so exploitable is that the controls protecting human accounts simply do not apply to them.

A non-human identity cannot use multi-factor authentication. It never logs out. It operates 24 hours a day with no working hours, no geographic pattern, and no typing behavior, which are exactly the signals security tools use to detect a compromised human account. When an attacker takes over an NHI, the activity looks like normal automation, because the attacker is using the credential exactly as it was designed to be used. Malicious and legitimate are indistinguishable.

The exposure is made worse by how NHIs are managed, or not managed. Roughly 47 percent of non-human identities are more than a year old and have never had their credentials rotated, making them ideal targets for long-term, low-noise exploitation. Around 8 percent are orphaned: the person who created the account has left, but the account still holds full access. And because NHIs are created ad hoc by developers and automation rather than through an HR-driven joiner-mover-leaver process, there is often no owner, no documentation, and no natural end date.

The types of non-human identity

NHI is an umbrella term. The main types each carry their own risk profile.

Service accounts run background jobs, database connections, and scheduled tasks, and are frequently over-privileged for convenience. API keys and OAuth tokens and OAuth tokens are bearer credentials that grant access to whoever holds them, and are heavily targeted, credential-linked breaches account for a large and growing share of incidents. Workload identities belong to containers, serverless functions, and virtual machines, and multiply as architectures shift to microservices. Machine certificates authenticate systems and services. And AI agents are the fastest-growing category: they authenticate, call tools, and act autonomously, and most legacy identity tools were never built to govern them.

How non-human identities get exploited

Three patterns show up repeatedly in real incidents.

Token abuse and lateral movement is the headline risk. Attackers steal OAuth refresh tokens or service-account credentials and ride the trusted connections between systems. The Salesloft-Drift breach is the reference case: compromised OAuth tokens let attackers reach more than 700 companies through connections that were never designed to be questioned. Secrets sprawl is the second: credentials leak out of secure storage into repositories, config files, and CI/CD pipelines, where automated scanners find them within minutes. Over-privilege and standing access is the third: an NHI granted broad permissions for convenience, never reviewed, becomes a wide blast radius waiting to be inherited by whoever compromises it.

How to secure non-human identities

Securing NHIs is not about applying human identity practices faster. It is about governing machine identities as first-class citizens, with the same rigor as human accounts. Five disciplines form the core.

Discover and inventory every NHI across cloud, SaaS, CI/CD, directories, and secret managers, because you cannot secure what you cannot see, and inventory completeness sits below 50 percent at most organizations. Assign an owner to each one, since an NHI with no owner is one no one will review or retire. Enforce least privilege, granting only the access each identity needs and stripping the standing over-privilege that widens blast radius. Manage credentials continuously, moving from long-lived static secrets toward short-lived, rotated, or ephemeral credentials, and pairing rotation with exposure detection, because rotation alone is not enough when attackers exploit a leaked secret within minutes. Monitor behavior, watching for an NHI acting outside its normal pattern, since behavioral monitoring is the safety net when a machine credential cannot present a second factor.

For the operational detail on running this as a program, see our guides to Ai Agent Identities and machine identity management.

Compliance is catching up

For a long time, audit processes focused on human users and left NHIs in a grey zone. That zone is shrinking. Frameworks including SOC 2, ISO 27001, NIS2, and ENS carry access-governance requirements that apply to non-human identities as much as human ones, and regulators are moving toward demanding explicit evidence of NHI governance. Treating NHIs as ungoverned is becoming a compliance liability as well as a security one.

How 8layers approaches non-human identities

Octagon, the identity posture module of the 8Layers platform, gives security teams visibility and control over every non-human identity across all their cloud providers, with the same depth as human accounts. Service accounts, API keys, OAuth tokens, and AI agents are inventoried, continuously scored, tied to an owner, and controlled, not discovered after a breach. Octagon calculates the compound risk an NHI carries across the systems it can reach through federation, which is exactly the exposure that single-tool approaches miss.

Because Octagon shares an identity data layer with Thor for detection and Compass for compliance, a risky non-human identity is watched, and tied to the compliance controls it affects, on one source of truth.

If you want to see how many unmanaged non-human identities are live in your environment, book a demo.

Frequently asked questions

What is a non-human identity?

A non-human identity (NHI) is a credential that software uses to authenticate and act without a person signing in, including service accounts, API keys, OAuth tokens, workload identities, machine certificates, and AI agents. NHIs let applications, services, and automation prove their identity and access systems, and they operate outside the controls built for human users, such as multi-factor authentication.

How many non-human identities does an enterprise have?

Non-human identities outnumber human ones by around 45 to 1 in the average enterprise according to the Cloud Security Alliance, rising to 144 to 1 in cloud-native and DevOps environments. Estimates vary by source and definition, from roughly 17 to 1 up to 144 to 1, but every source agrees the ratio is large and climbing rapidly as AI agents and automation scale.

Why are non-human identities a security risk?

Because the controls that protect human accounts do not apply to them. NHIs cannot use MFA, never log out, and operate continuously with no normal behavioral pattern to baseline against. They are frequently over-privileged, unowned, and configured with static credentials that rarely rotate, 47 percent are over a year old without rotation, which makes them persistent, low-noise targets. Two-thirds of enterprises have already been breached through a compromised NHI.

What is the difference between a non-human identity and a service account?

A service account is one type of non-human identity. NHI is the umbrella term covering service accounts, API keys, OAuth tokens, workload identities, machine certificates, and AI agents. So every service account is an NHI, but not every NHI is a service account.

How do you secure non-human identities?

Treat them as first-class identities: discover and inventory every NHI, assign each an owner, enforce least privilege, move from static credentials to short-lived rotated ones paired with exposure detection, and monitor behavior for anomalies. The goal is to govern machine identities with the same rigor as human accounts, since they now make up the majority of the identity estate.