IT Glossary
A non-human identity (NHI) is a digital identity for a machine, service, or AI agent. Learn what NHIs are, why they grow, and why they need governance.
July 3, 2026
A non-human identity (NHI) is a digital identity that belongs to a machine, application, service, or automated process rather than a person. Examples include service accounts, API keys, tokens, bots, and increasingly AI agents. In many organizations, non-human identities now outnumber human ones, yet they are often unmanaged, which makes them a fast-growing security blind spot.
Human and non-human identities differ in nature. A human identity belongs to a person, authenticates with a password, MFA, or passkey, and is usually governed. A non-human identity belongs to a service, app, or agent, authenticates with keys, tokens, or certificates, and is often unmanaged.
An integration uses an API key with broad access that was created years ago and never reviewed. It is a non-human identity with standing privilege and no owner, exactly the kind of credential attackers target. As automation and AI agents multiply, NHIs explode in number. They need the same governance as people: least privilege, ownership, rotation, and review. Treating them as out of scope is no longer tenable.
Service accounts, API keys, tokens, bots, and AI agents are all non-human identities. They authenticate and access systems without a person behind them.
Because they often hold broad, standing permissions, rarely rotate credentials, and are not reviewed like human accounts, which makes them attractive targets.
In many organizations, yes. The growth of automation, integrations, and AI agents has pushed NHIs well past the number of human accounts.
