Unmanaged credentials are secrets that exist outside approved governance, such as tokens, API keys, SSH keys, or passwords stored in local files, pipeline variables, or personal directories. They are hard to inventory, rotate, revoke, and audit, which makes them a persistent control gap in modern development environments.
Expanded Definition
Unmanaged credentials are NHI secrets that sit outside approved inventory, rotation, and revocation processes. In practice, they often appear as API keys in local config files, SSH keys in developer home directories, passwords embedded in scripts, or pipeline variables copied into ad hoc tooling. That makes them different from merely weak credentials: the core problem is governance failure, not just credential strength. In OWASP Non-Human Identity guidance, secret handling is treated as a lifecycle issue, and NIST-aligned identity programs increasingly expect credentials to be discoverable, attributable, and removable as part of broader control coverage, as reflected in the OWASP Non-Human Identity Top 10 and NIST SP 800-63 Digital Identity Guidelines.
Definitions vary across vendors on whether a credential becomes “unmanaged” the moment it escapes the vault or only after it is unreachable by policy tooling. NHIMG treats the term operationally: if security teams cannot inventory it, rotate it, or revoke it on demand, it is unmanaged. This distinction matters because unmanaged credentials can be static or temporary, but both become dangerous when they evade governance. The most common misapplication is assuming any secret stored outside a vault is automatically unmanaged, which occurs when teams overlook runtime-issued credentials that are still centrally controlled.
Examples and Use Cases
Implementing strong unmanaged-credential controls often introduces developer friction, because teams must balance deployment speed against the overhead of discovery, migration, and rotation.
- A CI pipeline stores an API key in plain text as a build variable, then copies it into job logs where it cannot be reliably revoked.
- A service account private key lives in a developer’s personal directory and is used for test automation without any ticketed approval path.
- A mobile app package includes embedded secrets, creating exposure that is hard to detect once the binary is distributed, a pattern discussed in NHIMG’s IOS app secrets leakage report.
- A shared admin password is passed through chat during an outage, bypassing normal controls and leaving no durable audit trail, similar to the patterns highlighted in Guide to the Secret Sprawl Challenge.
- A third-party integration keeps a long-lived token in a local file instead of using short-lived issuance, which conflicts with the control direction in Ultimate Guide to NHIs — Static vs Dynamic Secrets.
These cases are often identified only after a secret scanning alert, a breach notification, or an unexpected privilege escalation event. For broader lifecycle thinking, NHIMG’s NHI Lifecycle Management Guide pairs well with the control expectations in the NIST SP 800-53 Rev 5 Security and Privacy Controls.
Why It Matters in NHI Security
Unmanaged credentials are a direct path to credential theft, unauthorized machine-to-machine access, and hidden privilege persistence. Once a secret is copied into an uncontrolled location, standard identity controls no longer guarantee visibility, revocation, or accountability. That is why unmanaged credentials are a foundational NHI governance issue rather than a narrow secret-hygiene problem. They undermine zero trust assumptions, complicate access reviews, and weaken incident response because security teams may not know which systems trust the leaked secret. The 2024 Non-Human Identity Security Report found that 88.5% of organisations acknowledge their non-human IAM practices lag behind or are merely on par with human IAM, which helps explain why unmanaged secrets persist across pipelines and service accounts. This issue also appears in Top 10 NHI Issues and the Ultimate Guide to NHIs — Lifecycle Processes for Managing NHIs, where lifecycle control is treated as the core defense.
Organisations typically encounter the operational cost of unmanaged credentials only after a secret is exposed, at which point emergency rotation, dependency mapping, and privilege cleanup become operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST SP 800-63, NIST Zero Trust (SP 800-207) and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 | Covers improper secret management and uncontrolled NHI credentials. |
| NIST CSF 2.0 | PR.AA | Identity and access assurance depends on knowing which credentials exist and who can use them. |
| NIST SP 800-63 | AAL2 | Credential assurance concepts inform how strong and manageable machine secrets should be. |
| NIST Zero Trust (SP 800-207) | PR.AC-1 | Zero trust requires explicit, continuously verified identity trust, which unmanaged secrets undermine. |
| NIST AI RMF | AI systems inherit risk when embedded secrets or tokens escape governance. |
Track secret exposure as a lifecycle risk and require controls for discovery, containment, and remediation.
Related resources from NHI Mgmt Group
- Who should own the gap between SSO, PAM, and unmanaged credentials?
- Who is accountable when unmanaged credentials cause a compliance failure?
- Why do stale credentials and unmanaged service-account keys matter so much in cloud environments?
- Why do unmanaged service accounts and local credentials create such a large governance gap?
