Non-Human Identity Security for APIs, Bots, and Services
RCCE students will learn how machine identities are created, authenticated, authorized, rotated, monitored, and abused across APIs, workloads, automation pipelines, bots, and service accounts. RCCE students will learn to identify non-human identity sprawl, reduce standing privilege, design machine trust boundaries, secure token issuance, and apply governance to identities that operate without direct human interaction. The course covers practical scenarios ranging from inventory and risk analysis to lifecycle control, monitoring, and response. RCCE students will learn to analyze complex systems and think like an attacker to better defend the organization. This comprehensive course delivers practical knowledge applicable to real-world cybersecurity operations. Starting from foundational concepts, RCCE students will learn through a combination of concept explanation, practical demonstration, and hands-on exercises.
- Security Engineers building defensive controls
- Security Analysts and Blue Team members
- Systems Administrators with security responsibilities
- GRC and Risk Professionals supporting controls
- Professionals implementing Non-Human Identity Security for APIs, Bots, and Services
- Integrate privilege controls with identity providers and SIEM telemetry
- Execute hands-on tasks for what are non-human identities?
- Execute hands-on tasks for scale problem — covering Cloud-native architectures multiply machine identities exponentially.
- Execute hands-on tasks for why nhis matter now — covering Cloud-native architectures multiply machine identities exponentially.
- Manage service account privileges, rotation, and access boundaries
- Execute hands-on tasks for workload identities
- Execute hands-on tasks for lifecycle controls — covering No approval workflow for service accounts.
- Execute hands-on tasks for discovery sources
- Execute hands-on tasks for inventory attributes — covering IAM provider exports (Entra ID, Okta), Identity name, type, owner, team.
| Module 01 | Non-Human Identity Security |
| Module 02 | What Are Non-Human Identities? |
| Module 03 | Scale Problem |
| Module 04 | Why NHIs Matter Now |
| Module 05 | Service Accounts |
| Module 06 | Workload Identities |
| Module 07 | Human Identity |
| Module 08 | Non-Human Identity |
| Module 09 | Machine Identity Lifecycle |
| Module 10 | Lifecycle Controls |
| Module 11 | Discovery Sources |
| Module 12 | Inventory Attributes |
| Module 13 | Sprawl Indicators |
| Module 14 | Flow Steps |
All hands-on labs run on Rocheston Rose X OS. Students practice non-human identity security for apis, bots, and services by implementing the controls discussed in class, with a focus on real-world deployment, monitoring, and validation.
- Lab 1: Integrate privilege controls with identity providers and SIEM telemetry
- Lab 2: Execute hands-on tasks for what are non-human identities?
- Lab 3: Execute hands-on tasks for scale problem
- Lab 4: Execute hands-on tasks for why nhis matter now
- Lab 5: Manage service account privileges, rotation, and access boundaries
Upon successful completion of this course, students will receive an official RCCE Course Completion Certificate for Non-Human Identity Security for APIs, Bots, and Services, verifiable through the Rocheston certification portal.
- Full access to all course materials and slide decks
- Hands-on lab access on Rocheston Rose X OS environment
- Access to Rocheston CyberNotes
- Access to Rocheston Zelfire — EDR/XDR SIEM platform
- Access to Rocheston Raven — online cyber range exercise platform
- Access to Rocheston Vulnerability Vines AI