Glossary
Non-Human Identity (NHI)
Definition: A non-human identity (NHI) is any credential, API key, service account, or AI agent identity that authenticates to systems without a human directly behind it, and it is currently the fastest-growing, least-inventoried category of access in most enterprises.
Humans get offboarded when they leave. NHIs mostly don’t, because nobody owns the inventory the way HR owns headcount. That gap is exactly what let a small number of missed credentials (four, out of more than 5,000) sit unrotated long enough to become the entry point in a real breach. The uncomfortable fact for most security leaders: a service account created for a single migration project three years ago probably still has the access it was given for that project, because revoking access requires someone to remember the account exists. As AI agents get their own credentials to call tools and APIs, the NHI category is expanding faster than most governance programmes can track it.
Read the full case study on Substack: The Ghost in the Machine (Cloudflare/Okta, CIS Control 5) →