A non-human identity (NHI) is any identity that authenticates and acts in your systems without being a person: service accounts, API keys, OAuth applications, workload identities, bots and, increasingly, AI agents. In most organizations they far outnumber human users.
They are attractive to attackers because they often have broad permissions, rarely use multi-factor authentication, are seldom reviewed and can keep working long after anyone remembers why they were created.
AI agents act more like people than traditional service accounts do: they choose what to do, call many tools and can be steered by the content they read. That combination of autonomy and access means an agent's identity needs the same care as a privileged human account, plus controls specific to agents, such as limits on which tools they can call and approval gates for consequential actions. See governed autonomy.
How many non-human identities does a typical organization have?
It varies, but they commonly outnumber human identities many times over, especially in cloud-heavy environments.
Does MFA protect non-human identities?
Usually not directly, because most authenticate with keys, tokens or certificates. That is why secret hygiene, least privilege and behavior monitoring matter so much.
Anomali brings identity telemetry and threat intelligence together so unusual activity by any identity, human or not, can be spotted and investigated. Read Your employees are the blast radius for Anomali's view on identity risk.
See identity governance with Anomali or request a demo.