A non-human identity (NHI) is an identity that belongs to a machine, application or piece of software instead of a person. It authenticates, holds access and acts on its own, without anyone typing a password. Service accounts, API keys, bots and AI agents are all non-human identities.

What are the types of non-human identity?

• Service accounts used by applications and services.
• API keys and tokens that identify applications.
• Secrets and certificates used for machine authentication.
• Application and workload identities in cloud platforms and containers.
• Bots and automation such as scripts and robotic process automation.
• AI agents that act on behalf of a team or a person.

Why are non-human identities growing?

Automation, cloud services, integrations and AI all rely on software that needs access. Every new application, pipeline or agent tends to bring new identities with it, and they are created far more easily than they are retired.

Why are they a security risk?

They often hold broad, long-lived access, because it is easier to grant too much than to work out what is needed. They cannot use MFA, rarely have a clear owner and are seldom reviewed. A leaked credential gives an attacker a valid identity, and the calls look like normal automation.

How do they differ from human identities?

People join, move and leave, which gives IAM processes something to follow. Non-human identities have no such lifecycle, so they are easily forgotten. They also behave in repeatable patterns, which makes deviations easier to spot once a baseline exists.

How do attackers abuse them?

By finding exposed keys and secrets in code or documents, taking over service accounts through weak passwords or Kerberoasting, abusing applications with broad permissions and using the access to move between systems. Because the activity looks automated, it often goes unnoticed.

What does a non-human identity incident look like?

A key created for a one-off integration is left in a shared document. Years later it is used from an unfamiliar network to read customer records. The key has a broad scope, no owner and no review history, so nobody notices until data has left.

What are the warning signs?

• Use from new locations or networks.
• Sudden spikes in volume.
• Access to data the identity never used before.
• Activity outside its normal schedule.
• Use after the project or its owner is gone.

How do you manage non-human identities?

• Inventory every non-human identity, with an owner and a purpose.
• Scope each one to the narrowest access it needs.
• Store secrets in a vault and keep them out of code.
• Rotate credentials, or use short-lived ones where possible.
• Retire identities when the system they serve is gone.
• Monitor behaviour against a baseline.

What are common mistakes?

• Treating them as configuration, not as identities.
• Sharing one account across several systems.
• Leaving them without an owner.
• Keeping secrets in code and documents.
• Never rotating or retiring credentials.

How do they relate to blast radius?

A non-human identity with broad access has a large blast radius, and because it is rarely reviewed, nobody notices when it grows. Narrowing scope and removing unused identities shrinks that radius quickly.

How do AI agents change the picture?

An AI agent holds credentials and acts autonomously, so it is a non-human identity with the added ability to decide what to do. It needs an owner, narrow permissions, a record of its actions and approval for high-impact steps.

How does this relate to regulation?

NIS2 and DORA expect organisations to control and justify access to critical systems, and non-human identities are part of that access. They also extend to supplier and automated access.

Sharelock brings non-human identities into the same view as people, shows which ones hold excessive access and watches how they behave after authentication, so unusual use stands out against their normal pattern.

‍