Definition
A non-human identity, or NHI, refers to an account or entity that is not controlled by a person. These identities are used by applications, services, scripts, or devices to authenticate and authorize access to resources. In practice, NHIs are managed through credentials like API keys, certificates, or service principals, enabling automated processes to interact securely with systems. Understanding NHIs is crucial for effective access control and security posture management, as they represent a significant attack surface if not properly secured. For instance, a cloud function accessing a database would use a non-human identity. This differs from human identities, which are tied to individual users and their login credentials. NHIs are a key concept in cybersecurity domains covered by exams like Security+, CySA+, and CISSP.