# Non-Human & Machine Identity Security

> Scoped per engagement · AI Security · https://cisomarketplace.services/services/non-human-machine-identity-security

Assess and govern non-human identities — secrets, API keys, service accounts, workload identities, and AI agent identities — covering issuance, rotation, least-privilege, and lifecycle.

## In scope

- Secrets & API key inventory
- Service & workload identity review
- AI agent identity & privilege
- Rotation & lifecycle governance
- Least-privilege & vaulting

## Deliverables

- NHI security assessment report
- Identity inventory & risk ranking
- Secrets governance plan
- Lifecycle & rotation recommendations

## Tiers

### Essential: scoped

Point-in-time review for up to 3 cloud accounts and up to 25 repositories: inventory of secrets, API keys and service accounts, exposure and over-privilege findings, and a risk-ranked inventory with rotation recommendations.

Limits: cloud accounts 3, repositories 25

Includes:
- Secrets and API key inventory
- Service account privilege review
- Repository secret scanning
- Risk-ranked identity inventory
- Rotation recommendations

Excludes:
- Workload identities (Kubernetes, CI/CD, cloud roles)
- AI agent identities
- Secrets governance plan and lifecycle policy
- Vault implementation

### Advanced: scoped

Assessment for up to 10 cloud accounts and up to 100 repositories. Adds workload identities (CI/CD, Kubernetes, cloud roles) and AI agent identities and their privileges, a secrets governance plan, lifecycle and rotation policy, and least-privilege and vaulting design.

Limits: cloud accounts 10, repositories 100

Includes:
- Everything in Essential at the larger scope
- Workload identity review
- AI agent identity and privilege review
- Secrets governance plan
- Lifecycle and rotation policy
- Vaulting and least-privilege design

Excludes:
- Ongoing inventory refresh
- Vault or secrets manager implementation
- Rotating credentials on the client's behalf

### Enterprise: scoped

Continuous machine-identity governance program

Excludes:
- Vault or secrets manager licences
- Rotating credentials on the client's behalf

## Terms

Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW.

Scope this engagement: https://cisomarketplace.services/scope?service=non-human-machine-identity-security