Non-human identities are accounts used by software instead of people: application accounts, service principals, scripts, bots, and automation workflows. In cloud environments, they authenticate to APIs, access storage, start deployments, and move data between services. Because they are not tied to a single employee, they often outnumber human users and are easier to overlook.
They matter because every non-human identity can carry privileges, secrets, and trust relationships. If one is overprivileged, exposed, or poorly rotated, an attacker can abuse it for lateral movement, persistence, or stealthy data access. Defenders track these identities separately from user accounts, apply least privilege, rotate credentials, and monitor unusual API activity. In CIEM and IAM programs, non-human identities are a key source of entitlement sprawl and a common gap in access reviews.