They are using some fancy wording, but this just seems to be about regular service accounts (i.e. "bots") when they are mixed with user accounts in a SoA setting. No AI needed.
The collection provides a structured approach to self audit the security practice regarding non-human identities. The recent CCC showcased breach of a VW connected car repository based on the exploitation of those NHI.
I only known service accounts, which pose similar threat. Both AI and Humans can use service accounts and api-keys to pose the same threats.
But it's ultimately known and wide-spread as service accounts from what I know. Is non-human identity referring to a special case or attack vector?
> Non-human identities (NHIs) are used to provide authorization to software entities such as applications, APIs, bots, and automated systems to access secured resources. Unlike human identities, NHIs are not controlled or directly owned by a human. Their identity object and authentication often work differently to human, and common human user security measures do not apply to them.
https://owasp.org/www-project-non-human-identities-top-10/20...
- such as service accounts and access keys
- such as API keys, tokens, encryption keys, and certificates
- typically achieved using static credentials or OpenID Connect (OIDC)
- sensitive NHIs such as API keys, tokens, encryption keys, and certificates