Perpetual futures are cryptocurrency derivatives that let traders speculate on price without a set expiry date. They can be held indefinitely and are designed to track the spot market through periodic funding payments between long and short positions. Their structure makes them flexible, but also exposes traders to liquidation and volatility risk.
Expanded Definition
Perpetual futures are exchange-traded derivatives that reference an underlying asset, most often a cryptocurrency, without a fixed settlement date. Because there is no expiry, the contract relies on a funding mechanism that periodically transfers value between longs and shorts to keep the contract near spot price. That design makes perpetuals operationally different from dated futures and from simple spot exposure, because the position can remain open as long as margin and risk limits allow.
In crypto markets, the term is usually applied to leveraged trading instruments that intensify both gains and losses. Definitions are relatively consistent across venues, but usage in the industry is still evolving around custody, margining, and liquidation controls. For governance teams, the key distinction is that perpetual futures are not an identity construct, yet they often rely on NHI-controlled infrastructure such as exchange APIs, trading bots, and settlement services. The most common misapplication is treating perpetual exposure like a passive spot holding, which occurs when traders ignore funding costs and liquidation thresholds.
For a broader identity-security lens, NIST’s NIST Cybersecurity Framework 2.0 is useful for thinking about risk, access, and resilience around automated market interaction.
Examples and Use Cases
Implementing perpetual futures trading rigorously often introduces funding-rate and margin-management overhead, requiring organisations to weigh liquidity and leverage against higher operational and loss risk.
- A market maker maintains a long BTC perpetual position to express directional exposure while continuously monitoring funding payments and basis drift.
- An arbitrage desk pairs a perpetual contract with spot holdings to capture pricing inefficiencies, but only if liquidation thresholds remain tightly controlled.
- A crypto treasury team uses perpetuals for hedging, then routes execution through an AI trading agent that authenticates to exchange APIs using NHI-managed secrets.
- A risk system ingests exchange positions and alerts when funding costs, leverage, or volatility push a contract closer to forced liquidation.
- A control owner reviews how trading bots store and rotate API keys after reading the NHI guidance in Ultimate Guide to NHIs — 2025 Outlook and Predictions.
Because perpetual contracts can be held indefinitely, the practical use case is less about expiry management and more about continuous exposure management, especially when positions are opened and closed by autonomous systems. That makes the term relevant wherever a transaction system, not a human trader, is making repeated execution decisions.
Why It Matters in NHI Security
Perpetual futures matter in NHI security because they are frequently traded, monitored, or rebalanced by non-human identities that can move quickly and at scale. If an AI agent, service account, or API key is compromised, the resulting misuse may amplify losses through leveraged positions, rapid order placement, or unauthorized liquidation events. This is where NHI governance and financial risk intersect: secret storage, access scope, and approval boundaries become as important as the trading strategy itself.
The security issue is rarely the contract alone. It is the automation layer around the contract, including exchange credentials, webhook access, and bot permissions. NHI Mgmt Group notes that 97% of NHIs carry excessive privileges, which is especially dangerous when those identities can execute trades or cancel risk controls. In practice, this aligns with the access governance themes in NIST Cybersecurity Framework 2.0 and the need to constrain machine-to-machine authority. Organisations typically encounter the true risk only after a bot-driven position blows through controls, at which point perpetual futures become operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and OWASP Agentic AI Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST Zero Trust (SP 800-207) and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AC-4 | Access governance governs how automated trading identities are scoped and reviewed. |
| OWASP Non-Human Identity Top 10 | NHI-02 | Perpetual-futures automation depends on secrets that must be protected from sprawl and misuse. |
| OWASP Agentic AI Top 10 | LLM-06 | Agentic systems executing trades must be bounded to prevent unsafe tool use and runaway actions. |
| NIST Zero Trust (SP 800-207) | SC-7 | Zero trust principles support per-request verification for machine access to trading systems. |
| NIST AI RMF | AI risk management covers decision, oversight, and failure impacts for trading agents. |
Assess model-driven trading risk, monitor outputs, and enforce human oversight for critical actions.
