Exposing the OWASP Non-Human Identity Top 10

This talk introduces the OWASP Top 10 for Non-Human Identities, a vendor-neutral project that ranks the most serious ways machine accounts, service accounts and tokens get abused. The speakers start by explaining why defining a non-human identity is hard, since for many systems the credential ends up standing in for the identity. They then describe how the team drafted around twenty candidate risks and scored each one on exploitability, prevalence, detectability and technical impact, drawing on public breach reports and industry surveys.

Working from tenth place up to first, the speakers pair each risk with a real-world example, from a developer reusing an automation key to hardcoded credentials in CI/CD pipelines. Improper offboarding ranks first because orphaned identities often keep high privileges and few people know who owns them. The talk then covers AI agents, which inherit the risks of the identities they are given, such as browser agents with broad saved logins and MCP servers that rely on long-lived static keys.

A live demo follows, in which an attacker starting from a former employee's leaked cloud service account finds customer tokens in a storage bucket, pulls a hardcoded AWS key from a workflow file, and reaches administrator access. The practical takeaways for defenders are to record an owner for every machine identity, inventory third-party identities, and move CI/CD pipelines to OIDC-based federation instead of stored secrets.