Defining NHIs
While human users log in with SSO and MFA, the majority of activity in modern systems comes from non-human entities: service accounts, bots, microservices, and automation pipelines. These identities — often referred to as NHIs or machine identities — far outnumber human users and hold extensive privileges across environments.
A Kubernetes cluster might run hundreds of pods, each with its own service account. A CI/CD pipeline might spawn temporary IAM roles to provision infrastructure. A machine learning pipeline might use a long-lived API key to query sensitive data.
Why NHIs Are a Blind Spot
Unlike human identities, NHIs often:
- Lack individual ownership or lifecycle management
- Operate without MFA or contextual restrictions
- Possess broad, persistent access rights
- Are invisible in traditional IAM and access reviews
These characteristics make NHIs attractive targets. A single compromised service account can provide the attacker persistent access — and unless access logs are integrated with behavior-based anomaly detection, it may go unnoticed for days or weeks.
The 2019 Capital One breach is illustrative. An attacker exploited a server-side request forgery vulnerability to access an EC2 instance’s IAM role. That role had overly broad permissions and granted access to customer data in S3. Because the activity was consistent with what the role was permitted to do, traditional IAM monitoring didn’t flag it.
Establishing Control
Security teams must treat NHIs with the same rigor as user identities. That begins with discovery and inventory. Every service account, cloud role, and automation credential should be accounted for, tagged with an owner, and tied to a specific purpose.
From there, organizations should:
- Enforce least privilege on every machine identity
- Segment duties to avoid cross-environment compromise
- Rotate credentials automatically
- Integrate NHI access with SIEM/SOAR workflows
- Review entitlements regularly
This not only reduces attack surface but also aligns with auditor expectations under SOC 2, ISO 27001, and NIST SP 800-53.
