The OWASP Non-Human Identities Top 10, mapped to IAM jobs

What is on the list?

OWASP's ten, in order: NHI1 Improper Offboarding; NHI2 Secret Leakage; NHI3 Vulnerable Third-Party NHI; NHI4 Insecure Authentication; NHI5 Overprivileged NHI; NHI6 Insecure Cloud Deployment Configurations; NHI7 Long-Lived Secrets; NHI8 Environment Isolation; NHI9 NHI Reuse; NHI10 Human Use of NHI.

Which job addresses each?

• Lifecycle and governance (J2): NHI1 Improper Offboarding and NHI9 NHI Reuse. A service account needs an owner, a review and a removal date, as a person does.
• Privileged access (J4): NHI2 Secret Leakage and NHI7 Long-Lived Secrets. Vaulting and rotation, as CyberArk describes for secrets, address both.
• Application coverage (J3): NHI5 Overprivileged NHI where the account was created inside an application and never registered centrally. Orchid states, from its telemetry, that 67% of non-human accounts are created directly within applications; that is a vendor figure.
• Directory and single sign-on (J1): NHI4 Insecure Authentication, where a machine uses a weak method that a stronger one could replace.
• Threat detection (J5): NHI10 Human Use of NHI, a person signing in with a service account, which behavioral baselines can flag. Silverfort describes baselines per service account.
• Platform configuration: NHI3, NHI6 and NHI8 sit mostly with cloud and engineering teams, outside the five IAM jobs.

Why is ownership the common thread?

Most of the ten get easier when every non-human identity has a named human owner. Silverfort describes mapping service accounts to their human owners, sources and destinations. Without an owner, nobody can say whether an account is still needed.

How do AI agents change the count?

AI agents are non-human identities that act. Vendors added agent features across several jobs in 2026: Microsoft documents Entra Agent ID as generally available, Okta announced Resource Access Certifications for agent permissions, Lumos introduced MCP Governance for agent tool calls, and SailPoint made Agentic Fabric generally available. The column has a dated round-up.

A starting checklist

• Inventory non-human identities per system, including those created inside applications.
• Assign a human owner to each.
• Rotate or remove long-lived secrets.
• Review machine access on the same schedule as human access.