Non-Human Identity.

What is a non-human identity?

A non-human identity is a digital identity that belongs to software or a device, not to a person. Examples are service accounts, API keys and tokens that let one system prove who it is to another.

OWASP, the open security community, says production software environments are made of many applications that need to be identified, which results in what it calls non-human identities, or NHI. OWASP adds that application identities often use secrets as credentials, much like human sign-in. These secrets may be short-term, generated on demand, or long-term.

Do official bodies define the term?

The wording differs by source. The NIST glossary does not define “non-human identity”. It defines “non-person entity” instead. That entry, taken from CNSSI 4009-2022, reads: an entity related to information technology with a digital identity that acts in cyberspace, but is not a human actor. The page also says such entities can include organizations, hardware objects, software objects and information artifacts.

The OWASP Top 10 page for 2025 uses the term but, does not give a formal definition. It refers to service accounts and access keys, and to API keys and tokens.

What risks does OWASP list for non-human identities?

The OWASP Non-Human Identities Top 10 for 2025 names ten risks. In short, they are:

• Improper offboarding: not deactivating or removing a non-human identity when it is no longer needed.
• Secret leakage: exposing items such as API keys and tokens in unsanctioned storage.
• Vulnerable third-party non-human identity: compromised third-party identities used in development workflows.
• Insecure authentication: using deprecated, weak or vulnerable methods.
• Overprivileged non-human identity: giving more permissions than the task needs.
• Insecure cloud deployment configurations: exposed static credentials or badly checked OIDC tokens in CI/CD environments.
• Long-lived secrets: expiry dates that are too distant, or none at all.
• Environment isolation: reusing the same identity across environments, such as testing and production.
• Non-human identity reuse: using one identity across different applications or services.
• Human use of non-human identity: people using these identities for tasks that need an individual human identity.

OWASP says the project aims to help security professionals understand their exposure to non-human identity threats. It says the ranking considers exploitability, prevalence, detectability and impact.

How can teams reduce the risk?

The Top 10 titles themselves point to the main ideas. Remove identities that are no longer needed. Keep secrets out of unsanctioned places. Give each identity only the permissions it needs. Avoid secrets with no expiry, and avoid sharing one identity across applications or environments. This is a reading of the OWASP list, not a full program.

Is a non-human identity the same as a service account?

No. A service account is one kind. OWASP also names API keys and tokens, and the NIST entry covers a wider group of non-person entities, including hardware and software objects.

Is a non-human identity the same as a non-person entity?

They are close but not identical terms. “Non-person entity” is the phrase defined in the NIST glossary. “Non-human identity” is the phrase OWASP uses. Both describe digital identities that are not tied to a human actor.

How does it relate to nearby terms?

Related terms include credential theft, zero trust and attack surface. Each has its own page in this glossary.