2025 State of Non-Human Identities and Secrets in Cybersecurity
Entro Security - The 2025 State of Non-Human Identities and Secrets in Cybersecurity Report
Analysis of millions of real-world NHI secrets by Entro Security Labs reveals widespread, significant risks, emphasizes need for improved Secrets Management security practices
Entro Security, pioneer of the award-winning Non-Human Identity (NHI) and Secrets Management platform, released its research report, 2025 State of Non-Human Identities and Secrets in Cybersecurity.
The Entro Security Lab found that :
97% of NHIs have excessive privileges increasing unauthorized access and broadening the attack surface
92% of organizations are exposing NHIs to third parties, also resulting in unauthorized access if third-party security practices are not aligned with organizational standards.
44% of tokens are exposed in the wild, being sent or stored over platforms like Teams, Jira tickets, Confluence pages, code commits and more.
Such practices put sensitive information at serious risk of being intercepted and exposed–the root of all secrets and non-human identity breaches.
Entro Security Labs’ research reveals alarming trends in the handling of both human and NHIs, with significant misconfigurations and risks prevalent across organizations. Key findings include :
For each human identity, there are an average of 92 non-human identities.
An overwhelming number of non-human identities increases the complexity of identity management and the potential for security vulnerabilities
91% of former employee tokens remain active, leaving organizations vulnerable to potential security breaches
50% of organizations are onboarding new vaults without proper security approval which can introduce vulnerabilities and misconfigurations from the outset
73% of vaults are misconfigured, also leading to unauthorized access and exposure of sensitive data and compromised systems
60% of NHIs are being overused, with the same NHI being utilized by more than one application, increasing the risk of a single point of failure and widespread compromise if exposed
62% of all secrets are duplicated and stored in multiple locations, causing unnecessary redundancy and increasing the risk of accidental exposure
71% of non-human identities are not rotated within the recommended time frames, increasing the risk of compromise over time
Key Findings
The report highlights several high priority findings on the risks and threats related to NHIs and secret management. Each insight is supported by statistics and actual cases that demonstrate the severity and diversity of NHI risks across industries.
1- NHIs Lifecycle Management
Organizations commonly underestimate the amount of NHIs they have, overlooking lifecycle management. NHIs are frequently created without a consistent protocol for securing or retiring them, which leads to a significant number of unused or outdated identities. This lack of lifecycle management puts systems at risk as outdated credentials are still accessible long after they were intended to be used.
2- Excessive Permissions and Secret mismanagement
According to a survey, 73% of secrets are granted excessive permissions and over privileges, making them extremely vulnerable if exposed. Organizations also store secrets in many locations, with 91% of them duplicated and stored in insecure places, such as repositories or collaboration platforms. This redundancy violates the concept of the least privilege, which states that secrets should be granted only the necessary permissions.
3 - Secret Management Challenges in Various Environments
Securing and Managing Secrets like Certificates, Service Accounts, API Keys, and tokens are challenging but necessary for secure system operation, these challenges can be:
Exposure Risks: Misconfigured repositories, unencrypted communications, and improperly stored secrets all increase the risk of being exposed.
Dynamic Nature of IT Environments: Rapid variations in deployment cycles limit consistent secret rotation.
Encryption and Storage: The inconsistency of encryption standards makes secrets vulnerable to unauthorized access.
Integrating Secure Architectures for NHIs and Secrets
The report highlights the need for secure architecture which meets the specific requirements of NHI and Secret management. This includes establishing infrastructures that not only meet compliance standards but also integrate robust security measures at each stage of NHI process.
Design Complexity - Building a secure architecture for NHIs is extremely complex since it has to deal with a wide range of systems, secrets, and identity types. The architecture must reduce probable risks and make sure that NHIs can only be accessed by authorized systems or applications.
Compliance and Regulatory Requirements - Organizations impacted by GDPR, PCI-DSS, and other regulations possess extra obstacles when managing NHIs. Compliance requires strict monitoring and auditing of NHI usage, as well as additional security measures.
Balancing between Security and Automation - Automation is important for managing NHIs in real-time environments. However, automated systems must be configured properly to avoid any security risks, and NHI related process must be well secured to avoid any possible attacks.
Threat Detection and Response in NHI Security
This report emphasizes the extreme need for specialized monitoring tools and protocols to detect and respond to NHI-related risks and threats, as well as advanced techniques to improve detection and incident response in complex NHI interactions.
Anomaly Detection - It’s hard to detect and identify unusual behavior among NHIs because of the high number of interactions in automated environments. Advanced anomaly detection techniques are important to identify false anomalies from real threats.
Incident Response - To create an efficient incident response playbook for NHI-related incidents, it needs to have good understanding of how NHIs work and interact with the system. Organizations must develop incident response strategies that allow real-time detection and mitigation of NHIs threats.
Data from this report has been collected using a mixed-methods approach, integrating quantitative data analysis with qualitative insights derived from industry observations. The quantitative component focuses on statistical analysis of security incidents and vulnerabilities, while the qualitative aspect provides context and interpretation of these findings within the broader cybersecurity landscape. The data sources include proprietary data from Entro’s cybersecurity infrastructure, secondary data from publicly available industry reports and survey data from IT and security professionals.
