Non-human identities — service accounts, workload identities, API tokens, and the credentials AI agents carry — now vastly outnumber human users in most estates. The OWASP Non-Human Identity Top 10 gives the industry a shared vocabulary for the risks they introduce, the way the OWASP Top 10 did for web apps.
The canonical, authoritative list (with the precise category definitions) lives at the OWASP NHI Top 10 project. At a high level, the categories span improper offboarding of identities that outlive their purpose, secret leakage and long-lived static secrets, over-privileged grants, vulnerable third-party NHIs, insecure authentication, and humans using non-human identities interactively.
Why a shared framework matters. A standard taxonomy lets a security team map a finding to a named control, track coverage, and compare tools on the same axis — instead of every vendor inventing its own categories. It is also the natural spine for a threat feed: an incident tagged "NHI5 Overprivileged" or "NHI7 Long-Lived Secrets" is immediately actionable.
TrustFix analysis. We tag every item in this feed against the OWASP NHI Top 10 (and the agent/MCP threat classes below). Our thesis is that describing these risks is table stakes; the differentiator is making each one provable — a passport that attests least-privilege, an attestation clock that shows when a grant was last proven (not merely last used), and a monitor→remediate→re-attest loop that signs the correction. Read the source for the exact category list and definitions.