Glossary

30 terms from NHI security

Definitions framed from the machine-identity perspective, not the general IAM one. Every term is one or two paragraphs, linked to deeper reading where useful.

Identity & access

Non-Human Identity Also known as: NHI · Non Human Identity · Non-Human Identities · Machine Identity · 비인간 신원 · 비인간 아이덴티티 · 기계 신원 · 머신 아이덴티티 · NHI 보안: A digital identity used by software or a workload to authenticate without a person signing in for each request. Examples include service accounts and workload identities; API keys and tokens are credentials these identities may use. Check who owns the identity, which resources it can access, and how its credentials expire or are revoked.
IAM Also known as: Identity and Access Management · 신원 접근 관리 · ID 접근 관리: The discipline of managing digital identities (human and non-human) and controlling what each identity can do. In cloud context (AWS IAM, GCP IAM), it refers specifically to the policy and role systems that govern resource access.
Least Privilege Also known as: 최소 권한 · 최소 권한 원칙 · Principle of Least Privilege · PoLP: Least privilege means granting an identity only the actions and resources its task requires, then reviewing that access as the task changes. For example, a batch job that reads one bucket should not receive broad administrator permissions.
Zero Trust Also known as: 제로 트러스트 · 제로트러스트 · Zero Trust Architecture · ZTA: An architectural pattern that treats every request as untrusted by default, regardless of network location, and verifies identity and authorization on every call. For NHIs, this means continuous verification instead of "once issued, always trusted."
Service Account Also known as: 서비스 계정 · 서비스 어카운트: A service account is an account used by an application, script or workload to authenticate to another service. Its permissions, owner, credential lifetime and usage logs need review just like those of a human account.
Workload Identity Federation Also known as: WIF · 워크로드 신원 · 워크로드 아이덴티티 페더레이션: Workload identity federation lets a workload in one environment, such as GitHub Actions, exchange a trusted identity assertion for access in another, such as AWS or Google Cloud. When configured for the workload, it can replace a stored long-lived cloud key; the trust policy and resulting permissions still need review.
PAM Also known as: Privileged Access Management: Systems and processes that control, monitor, and audit privileged human access to critical systems. PAM does not generally cover NHIs; machine identities need their own lifecycle tooling, which is where Cremit Platform focuses.

Authentication protocols

SAML Also known as: Security Assertion Markup Language · SAML 2.0: SAML 2.0 is an XML-based standard for exchanging authentication assertions between an identity provider and a service provider. It is used for enterprise single sign-on. Cremit Platform supports SAML 2.0 SSO; confirm metadata, attribute mapping and sign-in behavior when connecting a particular identity provider.
SSO Also known as: Single Sign-On: Authentication scheme that lets a user log in once and access multiple applications without re-entering credentials. Typically implemented via SAML 2.0 or OIDC. In NHI context, SSO applies to human access into management tools; machine-to-machine auth uses service accounts, not SSO.
SCIM Also known as: System for Cross-domain Identity Management · SCIM 2.0: SCIM is a standard HTTP protocol for provisioning and updating users and groups across identity systems. An identity provider can send a deactivation change to a connected application, but timing and actual access removal depend on the integration and the application’s session handling.
OAuth Also known as: OAuth 2.0: OAuth 2.0 is an authorization framework for granting a client limited access to a resource without giving it the resource owner’s password. A token may represent a person’s delegated access or a client acting on its own behalf. Review the token’s issuer, scope, lifetime and owner before treating it as a non-human identity credential.
OIDC Also known as: OpenID Connect: OpenID Connect (OIDC) adds an identity layer to OAuth 2.0 so a client can verify an end user’s authentication and receive identity claims. It is one option for web and mobile sign-in; choosing between OIDC and SAML depends on the applications and identity provider.
JWT Also known as: JSON Web Token: JSON Web Token (JWT) is a compact format for carrying claims between parties. A JWT may be signed or encrypted, and its format alone does not grant access. If a service accepts a JWT as a bearer credential, exposure may permit access until the token expires or the service rejects it.

Secrets

Credential Also known as: 크리덴셜 · 자격증명 · 인증정보: A credential is information a system accepts to authenticate an identity or authorize access. Examples include passwords, API keys, access tokens and private keys used in authentication. A secret is information that must be kept confidential; the terms overlap, but not every secret is a credential, and a JWT is a credential only when a service accepts it for access.
Secret Scanning Also known as: Secret Detection · Credential Scanning · 시크릿 스캐닝 · 시크릿 탐지 · 크리덴셜 스캐닝 · 시크릿 검출: Secret scanning searches connected code, documents, messages or storage for exposed credentials and other secrets. A match is a lead to investigate, not proof that a credential works or was misused. Some credential types support issuer-side validity checks; others need manual review. Cremit scans configured sources such as repositories and collaboration tools, while eligible external discoveries can be monitored unless excluded, subject to organization settings.
Secret Sprawl Also known as: 시크릿 스프롤 · 시크릿 확산 · 시크릿 산재 · 크리덴셜 확산 · Credential Sprawl · Secrets Sprawl: Secret sprawl is the spread of credentials and other secrets across repositories, CI settings, documents and messages without a reliable inventory or owner. When a credential must be replaced, the team needs to find every system that uses the value and every copy that could expose it. The number of copies does not by itself show what the credential can access.
Credential Leakage Also known as: Credential Exposure · Credential Leak · 크리덴셜 노출 · 자격증명 유출: Credential leakage means a password, key or token became available outside its intended access boundary, for example through a public commit, log or client-side bundle. A scanner may find an old exposure; the finding alone does not prove the credential is still valid or was used. Record the evidence, check validity and access, contain a live exposed credential promptly, and review available issuer logs.

Threat patterns

NHI Kill Chain: Cremit’s editorial series on eight recurring credential risk patterns: Ghost, Shadow, Aged, Zombie, Drifted, Over-privileged, Public and Unattributed. Each pattern is a prompt to investigate ownership, current validity, access and evidence; the label alone does not establish compromise.
Overprivileged NHI Also known as: Over-privileged NHI · Overprivileged Non-Human Identity · OWASP NHI5: A machine identity whose IAM permissions exceed what the workload actually needs. OWASP NHI5:2025 flags this as a top-5 non-human identity risk because the blast radius on compromise is far larger than necessary, a read-only batch job running with admin rights will leak admin-level damage if the credential is stolen. Usually caused by copy-pasting policies, using default roles, or leaving expanded permissions behind after a one-time task.
Vulnerable Third-Party NHI Also known as: Third-Party NHI · Vendor API Key · OWASP NHI3: A third-party NHI is a machine identity or credential used by an external integration to access your systems or data, such as a vendor API key, bot token or OAuth grant. OWASP NHI3:2025 covers risks in these integrations. Record who authorized the connection, what it can access, how it is monitored and how to revoke it.
Shadow IT: Any tool, service, or integration that employees adopt without the security team's knowledge. In the NHI world, shadow IT creates shadow service accounts, shadow API keys, and shadow OAuth grants that never enter the inventory.
Ghost Key: An API key or credential that still authenticates, but whose owner has left the company or can no longer be identified. Part of the NHI Kill Chain.
Over-shared Key: An over-shared key is one credential copied into multiple projects, environments or tools. Revoking the old value at its issuer disables that value everywhere, but each dependent system needs a replacement and each exposed copy needs review. Shared copies make ownership and migration harder to trace.
Aged Key: A long-lived credential that has not been rotated in months or years. Time multiplies the damage: the value has had plenty of opportunity to leak, and attackers can plan around its predictable continued validity.
Zombie Key: A credential that still authenticates even though the service or integration it was meant for has been deleted or decommissioned. The key is alive; the system expects it to be dead.
Out of Scope Loophole: The pattern where credential exposure is not covered by bug bounty scope or secret manager inventory, so the problem persists despite having security programs in place. Common for SaaS credentials pasted into Notion, Jira, or Slack.
Blast Radius: The blast radius of a credential is the systems, data and actions an attacker could reach if that credential were usable. Determine it from the credential’s current validity, identity, permissions, resource policies and possible role chains. Copies of a key show exposure locations, not its access scope; possible access is not evidence that it was used.

Operations

Credential Rotation Also known as: Key Rotation · Secret Rotation · 자격증명 회전 · 키 로테이션 · 시크릿 로테이션 · 크리덴셜 회전: The process of issuing a new credential, updating every system that uses it, and revoking the old value. The hard part is never the new key, it is finding every place the old one lives.

AI / agents

MCP Also known as: Model Context Protocol: A protocol that lets LLM-powered tools connect to external data sources and actions in a structured way. From an NHI perspective, each MCP connection is a new trust boundary: the tool inherits the identity and credentials of whoever connected it.
A2A Also known as: Agent-to-Agent Protocol: A protocol for AI agents to communicate and coordinate with each other directly. Every A2A call is a credential action; inventory of agent identities becomes as important as inventory of human identities.

A term we should add?

The NHI field moves fast. Tell us what else belongs here.

Get in touch