What Is the OWASP NHI Top 10?

Quick answer
The OWASP Non-Human Identity Top 10 is a 2025 framework cataloging the top risks in machine credentials and agent identities.
It covers problems like over-privileged identities, insecure storage, and a lack of rotation and monitoring.
It’s the NHI counterpart to the classic OWASP Top 10, aimed at the fastest-growing attack surface.

What is the OWASP NHI Top 10?

The OWASP Non-Human Identity Top 10 is a community framework that ranks the most critical security risks affecting non-human identities — service accounts, API keys, OAuth tokens, and AI agent credentials. Published in 2025 as NHIs became the dominant identity type in cloud and AI systems, it gives security teams a shared vocabulary for a problem that had none.

The ten risks

The framework’s categories center on a recurring set of failures: non-human identities that are over-privileged (granted far more access than their job needs), insecurely stored (keys in code, logs, or shared files), unrotated (long-lived credentials that never expire), unmonitored (no one watches what the identity does), unowned (no human accountable), and reused across boundaries. It also flags risks from third-party integrations and from AI agents that act autonomously with delegated authority.

Why it matters

The NHI Top 10 formalizes what practitioners were already seeing: the credentials that run your infrastructure and agents now outnumber your employees, carry the most privilege, and get the least oversight. Adopting the framework gives a team a checklist to work through instead of discovering their NHI exposure only after a breach.

Where this bites vibecoders
A vibecoder’s first agent integration typically hits several NHI Top 10 items at once: a broad-scoped key, pasted in code, never rotated, with no owner. The value of the framework for a small team is as a self-audit — walk the list, fix the top item (usually over-privilege and insecure storage), and you’ve removed most of the risk.

Where AI coding assistants get this wrong

Generating wide-scope tokens “to make it work” instead of least-privilege scopes.
Storing machine credentials in source files or logs.
Never suggesting rotation or expiry for the keys it creates.
Failing to distinguish agent identities from the human who delegated them.

Checklist

Inventory NHIs and assign an owner to each.
Grant least-privilege scopes and short lifetimes.
Store credentials in a secret manager, never in code.
Rotate keys on schedule and on exposure.
Monitor NHI activity and alert on anomalies.

FAQ

Both are OWASP risk catalogs, but the NHI list targets machine credentials and agent identities rather than web application code. They’re complementary: the web Top 10 covers what your app does; the NHI Top 10 covers what your machines are authorized to do.

What is the most common NHI failure?

Over-privilege — identities granted more access than their function requires. It’s common because broad scopes are the easiest to set up, and it’s dangerous because a compromised key then has maximum reach.

Do I need a dedicated NHI tool?

Not necessarily. An inventory plus secret management and rotation gets most teams most of the way. Dedicated NHI governance tools help at scale, but the fundamentals are process, not product.

Sources

OWASP Non-Human Identity Top 10