top of page
FAQs
Get answers to all your NHI and NHI assessment-related questions.
General
A Non-Human Identity, or NHI, is a digital identity used by a system, application, service, API, automation workflow, cloud workload, or AI agent to access another system or resource.Examples include service accounts, API keys, access tokens, service principals, managed identities, automation bots, CI/CD pipeline accounts, machine-to-machine connections, and AI agents.These identities are not people, but they often have access to important systems, applications, cloud resources, and data.
Assessment Scope
The NHI Assessment can review machine identities such as:* Service accounts* API keys* Access tokens* Service principals* Managed identities* Cloud IAM users* Automation bots* CI/CD pipeline identities* Machine-to-machine connections* AI agents and agentic workflowsWhat the assessment will cover depends on the organization and what it wants to achieve.
Risk Areas
An orphaned Non-Human Identity is a machine identity that does not have a clear owner.This situation can occur when something comes to an end, like a project, or when someone moves on, such as an employee leaving, or a team undergoes changes. It can also happen when an application is no longer used, but for some reason, the identity associated with it stays active.Orphaned identities are risky because no one may be responsible for reviewing access, rotating credentials, approving usage, or decommissioning the identity.
Deliverables
Typical deliverables may include:Non-Human Identity inventory summaryRisk categorization by identity type and environmentOrphaned identity findingsCredential risk findingsLeast-privilege and excessive-access findingsStale or inactive identity findingsAI-agent identity risk observationsCompliance and governance gap summaryPrioritized remediation roadmapExecutive-level summary for leadershipTechnical findings summary for IAM, cloud, DevOps, and security teamsThe goal is to help your organization understand what exists, what is risky, and what to fix first.
Business Value
An NHI Assessment helps support compliance by giving organizations better visibility into ownership, access, credential management, privileged access, stale identities, and remediation priorities.This can help with internal audits, access reviews, regulatory readiness, and governance discussions.This provides leaders and technical teams with a better understanding of how machine identities are vulnerable.
Miscellaneous
No. Any organization using cloud services, APIs, automation, SaaS integrations, DevOps pipelines, privileged credentials, or AI agents can benefit from an NHI Assessment.Large enterprises may have a bigger machine identity footprint, but smaller organizations can still face serious risk from unmanaged service accounts, API keys, and automation credentials.
bottom of page