## Non-human identities security strategy: a 6-step framework Securing NHIs properly is not simple. It is a deliberate shift, from ad hoc NHI access control to intentional, risk-informed NHI governance that adapts as the organization evolves. That means aligning your architecture, operating model, and engineering priorities to support secure, scalable identity management across systems. To help with that, we’ll walk through a set of practical strategies for securing NHIs. But first, let’s set a strong foundation on three rules: 1. Always treat humans and machines differently. 2. Establish areas of responsibility and work closely with cross-functional teams (security, IAM, engineering). 3. Follow the [Zero Trust](https://www.cerbos.dev/blog/zero-trust-authorization) security model. Zero Trust is a set of security principles that define a design approach focused on eliminating implicit trust. These principles, based on [NIST Special Publication 800-207](https://nvlpubs.nist.gov/nistpubs/specialpublications/NIST.SP.800-207.pdf) (NIST SP 800-207), include: * Give the least privileged access possible * Segment your network * Always verify * Assume breach * Enforce access through centralized, policy-driven decisions.  👆With that foundation in place, you can build a structured, actionable NHI security strategy by following 6 key steps. Let’s unpack each of these steps to give you a better idea of what they include: 
### Step 1: Assess NHI exposure A sound NHI security strategy begins with identifying and quantifying NHI-associated risks across your environment. To properly understand your exposure, you need to understand how NHIs are used in your organization: * The roles they play * The systems they access * The data they touch Once you understand your risk during your NHI discovery, you can define your objectives. But getting to that level of clarity is easier said than done. Many teams struggle to get a complete picture of what identities exist, what they have access to, and where they’re active. I loved [the talk](https://www.youtube.com/watch?v=eDcmUVNiSkE&list=PLFkoMPnn5qssTrgPUdnF6fNkNpye3mJQx&index=12&ab_channel=CloudSecurityAlliance) from Itzik Alvas, Entro Security CEO, on how this was an issue even at Microsoft: *“The main problem we’re seeing in organizations, and the main problem we had at Microsoft is that usually organizations don’t really know how many non-human identities and secrets they have and where they are.”* So when you assess NHI exposure, do not limit it to service accounts and tokens in production. NHIs exist everywhere in your stack, from OAuth apps in the user domain to CI/CD secrets in development to AI agents. The development and AI domains are usually the riskiest, because credentials spread quickly and security practices are weaker. Looking at exposure by domain helps you see where controls will matter most\! 
### Step 2: Set objectives As you begin to set your NHI security objectives, base them on: * Zero Trust principles * Your use case and IAM programs * Your compliance requirements And remember to focus on outcomes that can be enforced through technical controls, not just written policies. You can set broad goals that cover all areas of NHIs, like Workload IAM, API access control, and workload federation. Alternatively, you can set more focused goals, like improving NHI permission management first. This is where [Cerbos Hub](https://www.cerbos.dev/product-cerbos-hub) can help. Once objectives are defined, you need a way to translate them into policies and enforce them consistently across services, workloads, and AI agents. Cerbos Hub makes that possible by giving teams one place to create, test, and deploy policies, and then log every authorization decision for audit and compliance (sorry, for a bit of self-promotion 🙃). Now let’s move to the next step.
### Step 3: Define success metrics for your NHI strategy By defining clear metrics as part of your strategy, you build in feedback loops that allow you to track implementation. For NHIs, these metrics can include: * Percentage of NHIs with scoped, short-lived credentials * Number of unused or orphaned service accounts detected and decommissioned * Time-to-revoke for compromised or deprecated identities * Credential rotation frequency and coverage * Number of high-risk NHIs flagged for access outside approved scopes These metrics let you iterate your NHI strategy based on real-world outcomes, not assumptions. [The CyberArk 2025 report](https://www.cyberark.com/CyberArk-2025-state-of-machine-identity-security-report.pdf) (PDF) found that 50% of surveyed organizations had a breach in the past year tied to compromised machine identities, most often through poorly scoped API keys, SSL/TLS certificates, and service account tokens. Tracking metrics like scoping, rotation, and time-to-revoke directly addresses those weak points and helps keep your organization out of that 50%.
### Step 4: Adopt NHI standards Standards provide technical scaffolding for your strategy. Adopting them upfront reduces integration complexity and improves your security posture over time. Your architecture should be supported by standards that promote portability and secure design by default. These are the standards we find most useful: | Standard | Description | Benefits | | ----- | ----- | ----- | | **[SPIFFE](https://www.cerbos.dev/blog/spiffe-identity-parsing-cerbos-pdp)** | Secure identity framework for workloads; supports ephemeral identity via X.509 or JWT SVIDs | Enables cryptographic workload identities, short-lived credentials, and strong attestation | | **WIMSE (IETF)** | Web Infrastructure Machine Security Ecosystem | Focuses on workload identity propagation, attestation, and fine-grained runtime authorization across clouds | | **SPICE (IETF)** | Secure communication protocol for isolated compute environments | Supports secure, authenticated comms in multi-tenant and virtualized environments | | **OpenID Connect M2M** | Extension of OIDC for machine-to-machine authentication | Supports interoperable and standards-based identity brokering between NHIs | | **FIDO Device Onboarding (FDO)** | Secure, zero-touch onboarding of edge and IoT devices | Automates identity provisioning and ownership verification at the edge | Choosing the standards now, before implementation, will give you the scaffolding needed to define which tools you need. (We cover tools in our ebook: [Securing AI agents and non-human identities in the enterprise](https://solutions.cerbos.dev/securing-ai-agents-non-human-identities-in-enterprises).)
### Step 5: Design the process Once you fully understand where your NHI security sits, and what your objectives are (and the standards you will rely on to guide you), you can map out how you are going to get there. As you go through this process, you’ll define how NHIs are created, governed, rotated, monitored, and decommissioned across teams and environments. We find this example [roadmap from Delinea](https://delinea.com/blog/how-to-manage-and-protect-non-human-identities-nhis#:~:text=Addressing%20NHI%20risks:%20a%20practical,the%20likelihood%20of%20credential%20exposure.) really helpful in illustrating what this process can look like in real life. It breaks things down into clear, practical steps.  The ASP.NET machine key leak in early 2025 showed what happens when these basics are missing. Thousands of long-lived keys ended up in public repos, creating a path for remote code execution. A clear process for credential rotation, monitoring, and retirement would have caught and removed those keys before attackers could exploit them\!
### Step 6: Assign team ownership With your operational practices mapped out, the next step is to map the process over your team. This way, you ensure that every step of implementation is owned by a responsible team member (or team). Typically, that will look something like this: * Security teams define risk models, enforce controls, and oversee auditability. * IAM teams manage access policy, identity issuance, and lifecycle orchestration. * Platform/DevOps teams implement tooling, rotate secrets, and enforce runtime controls. * Application teams consume secure identity patterns and surface misuse or gaps. As Felix Gaehtgens, VP Analyst at Gartner mentioned in one of KuppingerCole's video series: *“IAM teams are basically missing in action when it comes to machine IAM. This is creating this massive leadership vacuum.”* That vacuum often leaves security and engineering teams to pick up the slack, making clear ownership even more important. So, the NHI security responsibilities will depend on your company and who historically owned security. It’s also important to remember that security is a team sport, requiring cross-functional collaboration. I will leave here a quote which came up on one of my expert calls with CISO, and I truly love this opinion:  Once you have the high-level NHI security strategy in place, the next step is to make it work in practice. A strategy gives direction, but principles shape how teams actually secure and manage NHIs day to day. In [part two](https://www.cerbos.dev/blog/nhi-security-how-to-manage-non-human-identities-and-ai-agents), we cover the practical principles that put NHI and AI security into action. Our co-founder, Emre Baran, will take you through them. > These six steps together form the best practices for securing non-human identities in modern enterprises. By applying them, organizations can reduce over-privilege, enforce auditable access, and give both human and non-human actors clear boundaries.
## TLDR or key takeaways: * Non-human identities already outnumber human accounts in most environments and are often over-privileged or invisible. This creates one of the biggest security risks in your stack. Following best practices for securing non-human identities authorization, from exposure mapping to lifecycle management, is essential to address this. * Start with exposure mapping. Most orgs don’t even know how many NHIs and secrets they have or where they are, which makes blind spots inevitable. * Set objectives that can be enforced with technical controls. Focus on least privilege, Zero Trust, and aligning goals with compliance and IAM requirements. * Define success metrics to track progress. Metrics like credential rotation, time-to-revoke, and orphaned account cleanup directly address the weaknesses behind 50% of recent breaches (CyberArk 2025). * Adopt standards like SPIFFE, OIDC M2M, and FIDO Device Onboarding to enforce portable, cryptographic identity management across clouds and workloads. * Design the process for lifecycle management: creation, governance, rotation, monitoring, and retirement of NHIs. * Assign clear ownership across security, IAM, DevOps, and application teams. Gartner warns IAM is “missing in action” on machine identities, leaving a leadership vacuum that must be closed. [Cerbos Hub](https://www.cerbos.dev/features-benefits-and-use-cases/authorization-non-human-identities) helps organizations apply these best practices consistently across humans and machines, with centralized policy management, testing, and audit logging. ## FAQ ### What are Non-Human Identities (NHIs)? Non-Human Identities (NHIs) are digital identities used by machines, applications, services, and AI agents to authenticate and communicate inside enterprise systems. Examples include service accounts, API keys, secrets, tokens, workloads, certificates, and bots. Unlike human identities, which are tied to individual users and managed with usernames, passwords, and MFA, NHIs often operate automatically at scale. They are created quickly, connect across cloud and on-prem systems, and usually hold powerful privileges. Managing NHIs requires automated and scalable controls such as credential rotation, lifecycle governance, least privilege enforcement, and continuous monitoring. Without this, NHIs become a major attack surface, as seen in recent breaches where exposed tokens and service accounts were exploited to access sensitive data. ### Why is securing NHIs important? Securing NHIs is crucial because they often have access to sensitive systems and data. Without proper management, they can become entry points for cyberattacks. Recent breaches at Microsoft, Dropbox Sign, and HuggingFace showed how stolen service tokens and machine accounts can be used to break into systems. Securing NHIs lowers this risk, makes Zero Trust possible, and keeps you in line with standards like SOC2, ISO 27001, PCI DSS, HIPAA, and DORA. Stay tuned for our upcoming article on key compliance regulations and NHIs. ### How does Zero Trust architecture apply to NHIs? The Zero Trust model assumes that no entity, human or non-human, should be trusted by default. It requires strict verification for every access request, ensuring that NHIs have only the necessary permissions and are continuously authenticated and authorized. NHIs should only get the minimum permissions needed to perform their function (least privilege), and those permissions should be continuously validated. Controls like short-lived credentials, network segmentation, context-aware authorization, and continuous monitoring help enforce Zero Trust for NHIs. Applying Zero Trust to NHIs reduces the blast radius of a compromised token or account, limits lateral movement, and ensures access decisions are based on identity, context, and policy in real time. Tools like [Cerbos Hub](https://www.cerbos.dev/product-cerbos-hub) can help you follow Zero Trust across all your identities. ### What are common challenges in NHI security? Common challenges include a lack of visibility into NHI activities, over-privileged access, inadequate lifecycle management, and the absence of standardized security protocols for machine identities. You can read more about all NHI-related security challenges in our [ebook here](https://solutions.cerbos.dev/securing-ai-agents-non-human-identities-in-enterprises). ### What is the NHI security strategy? An NHI security strategy is a structured plan for managing non-human identities like service accounts, workloads, tokens, and AI agents. It starts with mapping exposure, then setting objectives based on Zero Trust, defining measurable metrics, adopting standards such as SPIFFE or OpenID Connect, designing lifecycle processes for creation and retirement, and assigning clear team ownership (and using tools like Cerbos Hub). The goal is to replace ad hoc controls with risk-informed governance that scales with your systems. ### Best practices for securing non-human identities using authorization? Best practices for securing non-human identities using authorization include mapping NHI exposure, enforcing least privilege, centralizing authorization with a PDP like Cerbos, adopting standards such as SPIFFE, and tracking measurable security metrics. These practices ensure workloads and AI agents are governed with the same rigor as human users.