NHIDR (Non-Human Identity Detection & Response)

Entro’s Non-Human Identity (NHI) Detection and Response technology goes beyond straight-forward monitoring

Entro Security

NHIDR (Non-Human Identity Detection & Response)

Entro’s platform goes beyond straight-forward monitoring. Entro’s Non-Human Identity (NHI) Detection and Response technology allows organizations to detect and respond to:

Compromised NHIs: By establishing behavioral models and tracking secret utilization in real-time, NHIDR instantly detects when secrets are being misused or Non Human Identities (NHI’s) are being abused.

Unauthorized access attempts: detect interactions involving NHIs and vaults from suspicious geolocations


Vault Dumps: to immediately stop mass downloads of secrets

Human interactions with vaulted secrets: to stop secret exposure at the source

Examples of risks Entro Detects and Responds to:

  • MongoDB token is used from a suspicious source IP address

  • Ex-employee token is used by suspicious actor IP

  • Secret was retrieved by a suspicious actor

  • Sensitive secret revealed by a human action

  • production secret fetched by human outside reasonable work hours

  • Idle identity fetched a production secret

  • Previously disabled token has been reactivated

  • Previously inactive token is now active again

  • Production token is used by IDE client

  • Secret was fetched by a new workload

  • Too many entities are fetching the same secret

In order to accomplish all these goals, Entro’s NHIDR technology reviews all past context and logging to:

  1. Establish a baseline of typical behaviors of each NHI with historical behavioral context in order to identify anything out of the ordinary. Anomalies are then highlighted with context for investigation purposes.

  2. Detect day 0 threats and anomalies, going beyond a simple inventory to real-time, continuous analysis of secrets behavior.

  3. Respond immediately to isolate and mitigate anomalous behavior.

  4. Integrate effectively with your existing task management, automation, and alerting solutions

  5. 24/7/365 monitoring of future interactions with NHIs, Secrets, and Vaults.

This proactive approach ensures that security incidents are addressed in real-time, reducing potential breaches before they occur. Entro also automates the remediation process by rotating or revoking compromised tokens, thus minimizing the manual effort needed to secure environments.