Non-Human Identity Governance
Non-Human Identity Governance
In the AI Agent era, "a legitimate account login" no longer means "a real human is operating." WuThreat ITDR Gateway 3.0 — without modifying business systems or installing any client — governs all invisible, uncontrolled, and untraceable non-human access through a 5-layer fingerprint + accountability tracing + app authorization matrix.
Full NHI Asset Inventory
Automatically discover and inventory all API keys, Service Accounts, AI Agent Tokens, and machine certificates enterprise-wide — eliminating non-human identity blind spots and establishing a single trusted asset ledger.
Automated Least-Privilege Control
Analyzes actual access behavior to automatically identify over-privileged accounts and intelligently recommend least-privilege policies — reducing lateral movement and privilege escalation risk.
Real-Time Anomaly Detection
Monitors non-human identity access behavior in real time — precisely identifying key leakage, abnormal call frequency, unauthorized time-window access, and permission violations with millisecond alert response.
5 Categories of Non-Human Identity
Full Coverage Across All NHI Types
From coding AI assistants embedded in developer IDEs, to enterprise RPA robots, to AI tools weaponized by external attackers — WuThreat classifies all non-human access into 5 categories, each with targeted identification and governance strategies.
Code Generation AI
Cursor IDE · GitHub Copilot · Claude Code · Codeium
AI assistants embedded in dev environments that access code repositories, test APIs, or even production databases using developer credentials. Traditional IAM sees only "developer normal login."
General AI Agent
OpenClaw · Devin · Kimi · Custom Agents
Autonomous agents that hijack employee OAuth credentials for cross-system operations. Core risk: OAuth scope violations and autonomous decisions without human review.
Browser Hijacking AI
OpenAI Operator · Browser Use · AutoGPT Browser Mode
Directly takes over real browser sessions, bypassing completed MFA. Traditional bot detection (honeypots) is nearly ineffective against these.
Enterprise RPA
UiPath · Alibaba Cloud RPA · Custom Python Bots
Legitimate enterprise automation robots, often mistakenly flagged as attack sources. Require whitelist management and credential lifecycle auditing — not blocking.
External Attack Tools
Hermes Agent · LangChain Scrapers · Browser Use Credential Stuffing Scripts
Open-source AI tools repurposed as automated attack weapons. WAF sees only legitimate HTTPS traffic; credentials are real (obtained via stuffing). Completely invisible to WAF.
Non-Human Identity Capabilities
NHI Governance Capabilities
From API keys to AI Agents — full lifecycle management for all non-human identity types enterprise-wide. Automated inventory, privilege governance, anomaly detection, and compliance auditing in one unified solution.
API Key Full Lifecycle Management
Automatically discovers API keys scattered across systems, centrally controls validity and permission scope, detects key leakage and abnormal calls in real time, and supports scheduled auto-rotation.
Service Account Privilege Governance
Full inventory of service account distribution and permission configuration — precisely identifies over-privileged accounts and zombie accounts, auto-recommends least-privilege policies with one-click decommissioning.
AI Agent Identity Access Control
Assigns independent least-privilege identities to each AI Agent, preventing injected malicious instructions from using Agent credentials to bypass business authorization or perform lateral penetration.
Zombie Credential Auto-Cleanup
Credentials unused for 90+ days are automatically flagged with warnings; expiring certificates trigger smart reminders — preventing stale credentials from becoming attackers' hidden entry points.
NHI Asset Overview
5-Layer Fingerprint Stack
Multi-Layer Identity Fingerprinting
A single fingerprint layer is easily forged; five stacked layers are not. L1 to L5 assess network, application, device, behavior, and identity dimensions jointly — even if an attacker bypasses the first three layers, behavioral layer L4 exposes the perfectly-regular request intervals and absence of mouse/keyboard events that AI Agents physically cannot replicate.
Captures TLS handshake characteristics to precisely distinguish client types: Chrome browser / Python requests / curl / Cursor IDE. Spoofing requires reimplementing the full TLS protocol stack — the highest-cost evasion method.
Collects User-Agent, Accept-Language, Accept-Encoding, and custom headers. Official AI tools rarely actively spoof UAs; header order and combination characteristics expose impostors.
Collects Canvas render hash, WebGL hash, font list, resolution, and timezone. Headless Chrome typically has missing Canvas, zero-value WebGL hash — a strong automation signal. Spoofing requires simulating a full GPU rendering context.
Captures mouse trajectories, keystroke rhythms, and request interval mean/std deviation. A request interval std deviation <50ms triggers a "regular request" signal — human behavior that AI Agents physically cannot fully simulate.
Correlates employee login sessions within 5 minutes of the same IP, historical sessions within 1 hour from the same device fingerprint, and OAuth tokens — tracing every non-human access back to a responsible human. Auto-binds at confidence ≥80%; traces accountability with 95%+ accuracy.
Detection Accuracy
Block Rate
False Positive Rate
Per Request
Typical Risk Scenarios
Real-World NHI Attack Scenarios
Non-human identities typically carry high privileges, exist in large numbers, and lack monitoring — making them APT attackers' preferred entry point for bypassing traditional IAM defenses.
Cursor AI Accesses Production Database
A developer asks Cursor to "check the user table in the production database." Cursor immediately uses the developer's OAuth token to access production — traditional IAM sees only "developer normal login," completely blind to AI being the actual operator.
AI Agent Aggregates Cross-System Sensitive Data
A finance user authorizes OpenClaw AI to run monthly reports. The Agent auto-logs into CRM to pull customer data, then cross-accesses ERP invoice data — OAuth scope is violated, but the IAM system cannot detect it.
Browser Use Automated Credential Stuffing
An attacker uses the Python library browser-use to simulate login attempts. WAF sees legitimate HTTPS traffic; credentials are real (obtained via stuffing). 4,912 requests are completely invisible to traditional defenses.
Core Value
Core Value
Why Is NHI Governance the Key to Zero Trust?
Non-human identities typically outnumber human accounts by 10× or more — representing the largest attack surface expansion in modern enterprises. Comprehensive NHI governance is the prerequisite for Zero Trust architecture to truly take effect.
Eliminate NHI Blind Spots
From API keys to AI Agents — full automated discovery builds a single trusted NHI asset ledger, making every machine identity queryable, manageable, and controllable.
Automated Least Privilege
No more manual security reviews. Behavior-driven analysis automatically recommends least-privilege policies — from concept to practice, significantly reducing lateral movement and privilege escalation risk.
Full Compliance Support
NHI asset ledgers, access logs, and privilege change audits are fully retained — meeting MLPS 2.0, ISO 27001, and industry regulatory requirements for identity and access management compliance.
vs. Traditional Security
How WuThreat ITDR Differs
Traditional products ask "is the account legitimate?" — we ask "is a real human operating it?" This solution complements existing IAM / WAF / DLP / SIEM, filling the gap in non-human identity subject determination.
| Capability | Traditional IAM | Traditional WAF | DLP | EDR | WuThreat ITDR Gateway |
|---|---|---|---|---|---|
| Identify AI Agent Tool Type | ✗ | ✗ | ✗ | △ Endpoint visible |
✓ 12+ mainstream tools |
| Distinguish AI Agent from Human | ✗ | △ Simple rules only |
✗ | △ Endpoint visible |
✓ 5-layer fingerprint verdict |
| Attribute to Responsible Human | △ Account-level only |
✗ | ✗ | ✗ | ✓ 95%+ accuracy |
| Block AI Agent Unauthorized Access | ✗ | △ Coarse-grained |
✗ | △ Endpoint blocking |
✓ App authorization matrix |
| Zero Business System Changes | ✓ | ✓ | △ Proxy needed |
✗ Agent install needed |
✓ Gateway bypass, zero-intrusion |
| Cloud SaaS AI Support (e.g., Operator) | ✗ | △ Traffic visible, not identified |
✗ | ✗ No endpoint process |
✓ 5-layer full coverage |
Frequently Asked Questions
Common Questions Answered
We already have IAM and WAF. Why do we need this?
IAM and WAF verify "account legitimacy" and "traffic legitimacy." But in the AI Agent era, a legitimate account + legitimate traffic ≠ a human operating it. This solution fills the "identity subject determination" layer — answering "is this session a human or an AI?" We are complementary to IAM/WAF, not a replacement.
Will it false-positive on our compliant enterprise RPA bots?
No. We designed a "linked natural person session" as a -50% negative weight factor — as long as the RPA can be linked to an employee or department, the confidence score drops immediately. Compliant RPA false positive rate is <1%. One-click whitelisting is also supported (no alerts, but audit logs are still recorded).
How do you handle employee-authorized AI Agents, like using AI to run reports?
This is a typical "requires review" scenario. We: ① Identify the AI tool (greylist) → ② Link the employee identity (natural person session) → ③ Trigger DingTalk/Slack approval → employee confirms or the request is blocked. Employees can still use AI productively without allowing unauthorized AI operations.
Does deployment affect business systems or require code changes?
No business system changes required. The gateway deploys at the traffic entry point (inline or bypass mirror), passively observing TLS/HTTP characteristics. No client/agent installation, no SDK modification, no DNS changes. Bypass mode adds zero latency; gateway mode adds <2ms per request. Standard deployment completes in 3–5 business days.
Expert Consultation
Dedicated Identity Security Strategy Consultation
Facing complex identity threats (ITDR) and compliance challenges, you need customized solutions. Contact the WuThreat Identity Security expert team immediately, and we will provide you with tailored services based on your business architecture and industry characteristics:
Customized Practical Solutions
Tailored to your business scenarios
Emerging Threat Strategic Planning
Forward-looking long-term security strategy
Professional Technical Support
Expert team providing full technical assistance
Scan WeChat QR Code to Consult