Service accounts and other non-human accounts created inside applications

What is a non-human account?

It is an account used by software rather than a person: a service account that runs a scheduled job, an integration user one application uses to call another, an API key held by a script, a workload identity in a cloud, and now accounts used by AI agents. They hold real access and they rarely change hands formally, which is why they outlive the projects that created them.

Where are they created?

Some are created in a central directory or cloud identity system. Many are not: they are created inside the application that needs them, by whoever set up the integration. Orchid Security's Identity Gap: 2026 Snapshot states that 67% of non-human accounts are created directly within applications, based on its anonymized telemetry from enterprise applications in North America and Europe between April 2025 and March 2026. That is the vendor's finding from its own data, not a measurement by this site.

What goes wrong?

The OWASP Non-Human Identities Top 10 names the common failures: Improper Offboarding (NHI1), Secret Leakage (NHI2), Vulnerable Third-Party NHI (NHI3), Insecure Authentication (NHI4), Overprivileged NHI (NHI5), Insecure Cloud Deployment Configurations (NHI6), Long-Lived Secrets (NHI7), Environment Isolation (NHI8), NHI Reuse (NHI9) and Human Use of NHI (NHI10). Several of them start with an account nobody knew existed.

What do the scored vendors document?

• SailPoint made Agentic Fabric for AI and machine identities generally available in August 2026 and completed its acquisition of Entro Security, which secures non-human identities, secrets and tokens, in June 2026.
• Microsoft prices Entra Workload ID at $3.00 per workload identity per month, and Entra Agent ID is generally available.
• Veza states its access reviews reveal machine and service accounts, including those outside identity platforms.
• Orchid Security detects hardcoded accounts and credentials inside applications.

The scores for this criterion, and the reason behind each, are on the rankings page.

What should every non-human account have?

1. An owner: a named person or team accountable for it.
2. A purpose: the system and job it serves.
3. The least access that purpose needs.
4. A credential lifetime and a rotation date.
5. A last-used date, so unused accounts can be removed.
6. A record of where it was created, so the next review knows where to look.

Sources