Digital identities assigned to machines, services, applications, bots, and automated workloads rather than to human users. NHIs include service accounts, API keys, OAuth tokens, certificates, and secrets used by software to authenticate and authorise actions. As identity attack surfaces expand, managing and securing NHIs has become a critical discipline alongside traditional human IAM.
The majority of credentials in enterprise environments now belong to non-human entities. Compromised NHIs — such as leaked API keys or service account tokens — are a primary attack vector, making NHI governance essential for fraud and security teams.
When Non-Human Identity (NHI) appears in a vendor claim, control description, policy, or assessment, record the exact meaning being used and the boundary it covers. Ask what is measured, which systems and users are in scope, what evidence supports the claim, how exceptions are handled, and when the evidence was last reviewed. Similar labels can describe different implementations, so a term match alone is not proof that a requirement is met.
Do not assume that two policies, standards, or products use Non-Human Identity (NHI) in exactly the same way. A label may describe an objective, a technical mechanism, an operating process, a measurement, or a commercial feature. Check the surrounding definition and avoid expanding a narrow statement into a broader assurance claim.
For a durable review, note the authoritative source, publication or version date, applicable system boundary, and any thresholds or exclusions. If the meaning is disputed or changes over time, preserve both the original wording and the interpretation used for the decision. That makes later reassessment possible without treating this glossary entry as a substitute for the governing source.
Category: cybersecurity. This entry is part of the Identity Technologist Glossary, a practitioner reference for identity verification, KYC/AML, biometrics, fraud prevention, authentication, security, and compliance terminology.
Last reviewed: 2026-05-21