Non-Human Identity.

What Is a Non-Human Identity?

A non-human identity is a digital identity that belongs to software or a device, not to a person. Examples are service accounts, API keys and tokens that let one system prove who it is to another.

OWASP, the open security community, says production software environments are made of many applications that need to be identified. This results in what it calls non-human identities, or NHI. OWASP adds that application identities often use secrets as credentials, much like human sign-in. These secrets may be short-term, generated on demand, or long-term.

Do Official Bodies Define the Term?

The wording differs by source. The NIST glossary does not define “non-human identity”. It defines “non-person entity” instead. That entry, taken from CNSSI 4009-2022, reads: an entity related to information technology with a digital identity that acts in cyberspace, but is not a human actor. The page also says such entities can include organizations, hardware objects, software objects and information artifacts.

The OWASP Top 10 page for 2025 uses the term but, does not give a formal definition. It refers to service accounts and access keys, and to API keys and tokens.

What Risks Does OWASP List for Non-Human Identities?

The OWASP Non-Human Identities Top 10 for 2025 names ten risks. In short, they are:

• Improper offboarding: not deactivating or removing a non-human identity when it is no longer needed.
• Secret leakage: exposing items such as API keys and tokens in unsanctioned storage.
• Vulnerable third-party non-human identity: compromised third-party identities used in development workflows.
• Insecure authentication: using deprecated, weak or vulnerable methods.
• Overprivileged non-human identity: giving more permissions than the task needs.
• Insecure cloud deployment configurations: exposed static credentials or badly checked OIDC tokens in CI/CD environments.
• Long-lived secrets: expiry dates that are too distant, or none at all.
• Environment isolation: reusing the same identity across environments, such as testing and production.
• Non-human identity reuse: using one identity across different applications or services.
• Human use of non-human identity: people using these identities for tasks that need an individual human identity.

OWASP says the project aims to help security professionals understand their exposure to non-human identity threats. It says the ranking considers exploitability, prevalence, detectability and impact.

What Can Teams Do About These Risks?

OWASP gives prevention advice on the page for each risk, for example improper offboarding, secret leakage and identity reuse. The steps below sum it up.

Is a Non-Human Identity the Same as a Service Account?

No. A service account is one kind. OWASP also names API keys and tokens, and the NIST entry covers a wider group of non-person entities, including hardware and software objects.

Is a Non-Human Identity the Same as a Non-Person Entity?

They are close but not identical terms. “Non-person entity” is the phrase defined in the NIST glossary. “Non-human identity” is the phrase OWASP uses. Both describe digital identities that are not tied to a human actor.

Which Security Ideas Does Non-Human Identity Touch?

Related terms include credential theft, zero trust and attack surface. Two pages in this glossary cover close ideas: least privilege and AI agents, which often sign in with their own credentials. A third, credential harvesting, covers how secrets are stolen.

This page gives the short definition. For a longer look, read our article on non-human identity as a way in.