What is a non-human identity audit?

A non-human identity (NHI) audit reviews every machine credential in your environment (service accounts, API keys, OAuth apps, tokens, certificates and AI agent identities) to confirm each one has an owner, is still needed, has only the access it needs, and uses short-lived, rotated secrets.

What is the OWASP Non-Human Identities Top 10?

It is OWASP's 2025 list of the ten most important risks for machine identities: improper offboarding, secret leakage, vulnerable third-party NHIs, insecure authentication, overprivileged NHIs, insecure cloud deployment configurations, long-lived secrets, environment isolation, NHI reuse and human use of NHIs.

How often should non-human identities be audited?

Review high-privilege and production NHIs at least quarterly and all NHIs at least twice a year, and whenever an application, integration or AI agent is retired or changes owner. Continuous discovery is better than periodic spreadsheets.

Is my identity inventory uploaded?

No. The audit runs entirely in your browser and nothing is sent to a server. Do not paste secret values; names and metadata are enough.

Free · private · mapped to the OWASP NHI Top 10 (2025)

Non-human identity audit in 10 minutes

Service accounts, API keys, tokens, OAuth apps and AI agents now outnumber your employees, and most have no owner. Scan your inventory or answer 10 questions to get an NHI risk score and a prioritised fix list.

Flags ownerless, stale, over-privileged, shared and never-expiring credentials
Every finding is mapped to the OWASP Non-Human Identities Top 10 and SOC 2 access controls
Runs in your browser. Paste names and metadata only, never secret values.

Start the audit

1. Add your identity list

Export from your cloud console, IdP, secrets manager or a spreadsheet and paste it with the header row, or upload a CSV. Useful columns: name, type, owner, environment, privilege, last used, last rotated, expires, used by, auth method, third party, human use. Only name is required; every extra column adds checks.

Your non-human identity audit

0/ 100

Findings by OWASP NHI Top 10 risk

Identities that need action

Identity	Findings	Owner	Privilege

This audit is a planning aid based on the data you provide. It is not a penetration test, an audit opinion or legal advice. OWASP is a registered trademark of the OWASP Foundation; this tool is not affiliated with or endorsed by OWASP.

What is a non-human identity (NHI)?

A non-human identity is any credential that software uses to authenticate: cloud service accounts and IAM roles, API keys, OAuth apps and refresh tokens, CI/CD tokens, SSH keys, TLS certificates, bot accounts and, increasingly, AI agents that call tools and APIs on a user's behalf. They rarely have MFA, often never expire and are created by developers without a named owner, which makes them the easiest way into most environments.

The OWASP Non-Human Identities Top 10 (2025)

Risk	What to check in your audit
NHI1 Improper offboarding	Identities with no owner, or not used in 90 days, that belong to retired apps, integrations or people who left.
NHI2 Secret leakage	Keys and tokens in code, tickets, chat, logs or wikis instead of a secrets manager; secret scanning in place.
NHI3 Vulnerable third-party NHI	OAuth apps, SaaS integrations and IDE or AI plugins with broad scopes into your systems.
NHI4 Insecure authentication	Passwords, basic auth and static keys where short-lived tokens or workload identity federation are available.
NHI5 Overprivileged NHI	Admin, owner or wildcard permissions on identities that only need read or a narrow write scope.
NHI6 Insecure cloud deployment configurations	Static credentials in CI/CD pipelines instead of OIDC-based federation.
NHI7 Long-lived secrets	Secrets with no expiry, or not rotated in the last 90 days.
NHI8 Environment isolation	The same identity or secret used in development, staging and production.
NHI9 NHI reuse	One service account shared by several applications, so one compromise spreads.
NHI10 Human use of NHI	People logging in or running scripts with service accounts, which breaks accountability.

How to run a non-human identity audit

Build the inventory. Export service accounts and roles from each cloud, app registrations and OAuth grants from your IdP, keys from your secrets manager, tokens from CI/CD, and a list of AI agents and the tools they can call.
Assign an owner to every identity. An identity without an accountable human is the first thing to disable.
Remove what is not used. Disable identities unused for 90 days, then delete them after a grace period.
Right-size access. Replace admin and wildcard permissions with the narrowest scope that works, per environment.
Shorten secret lifetimes. Move to federation and short-lived tokens; rotate what must stay static.
Separate and don't share. One identity per application per environment; no human use of service accounts.
Make it continuous. Track new identities as they're created, not in an annual spreadsheet.

AI agents are non-human identities too

Every AI agent that reads email, queries a database or calls an API acts through a credential. Treat each agent as an NHI: give it its own identity, a named owner, scoped tool permissions, human approval for high-impact actions and an audit trail. Include agents in this audit by listing them with type “AI agent”.

Frequently asked questions

Is my data uploaded?

No. Everything runs in your browser. Paste names and metadata only. Never paste secret values into any web tool.

What columns are recognised?

Name, type, owner, environment, privilege or role, last used, last rotated or created, expires, used by (applications), auth method, third party and human use. Headers are detected automatically and you can change the mapping.

How is the score calculated?

For an inventory scan, the score reflects how many identities are free of high-risk findings (no owner, stale, admin, human use, never expiring) and medium findings. For the questionnaire, each answer is weighted by the OWASP risk it covers.

How often should we audit NHIs?

At least quarterly for production and privileged identities, and whenever an app, integration, agent or owner changes. Continuous discovery is better than periodic spreadsheets.