Delta Sharing

Delta Sharing is an open protocol for sharing live data across platforms without copying it into a separate store. Recipients authenticate to query the source directly, which reduces duplication, latency, and pipeline overhead. For security teams, the main value is governed access with auditability preserved at the data source.

Expanded Definition

Delta Sharing is a governed data-sharing protocol that lets one platform expose live datasets to another without exporting a duplicate copy. In NHI and IAM operations, that matters because the consumer authenticates to the source system, so access can be traced, revoked, and audited where the data actually lives. The protocol is most useful when teams need cross-platform analytics, partner access, or controlled model input while preserving source-of-truth governance.

Usage in the industry is still evolving. Some organisations treat Delta Sharing as a data-product interface, while others treat it as an access-control pattern layered onto lakehouse workflows. Both views are workable, but neither should be confused with a full governance program. Proper implementation still depends on entitlement review, token protection, dataset classification, and consistent monitoring aligned to NIST Cybersecurity Framework 2.0 and internal policy. NHIMG’s guidance on NHI control maturity also applies, especially where data access is mediated by service principals and API tokens in production systems. The most common misapplication is assuming the absence of data copying eliminates risk, which occurs when teams overlook consumer authentication, token lifecycle, and downstream re-sharing.

Examples and Use Cases

Implementing Delta Sharing rigorously often introduces governance overhead, requiring organisations to weigh lower duplication and faster access against tighter entitlement management and operational review.

• A data platform shares a live finance table with an external auditor through source-side access, avoiding file exports while preserving logs and revocation at the origin.
• A machine learning team consumes curated feature data directly from a governed source, reducing pipeline sprawl but increasing the need to protect service account credentials.
• A partner analytics workflow uses Delta Sharing to expose only approved columns, which supports least privilege but requires careful schema review when the dataset changes.
• A security team pairs sharing with identity controls described in the Ultimate Guide to NHIs so the token or service principal used for access is tracked as a non-human identity.
• An operations team uses the protocol to replace ad hoc database replicas, then maps the access path to NIST Cybersecurity Framework 2.0 controls for access management and logging.

Delta Sharing is most defensible when each recipient is known, each dataset is classified, and each access path can be reviewed without relying on informal trust between teams.

Why It Matters in NHI Security

Delta Sharing becomes an NHI security issue because the protocol typically depends on service accounts, API tokens, or other machine credentials to access the source dataset. If those identities are overprivileged, long-lived, or poorly inventoried, the sharing layer can become a quiet path to sensitive data exposure. NHIMG data shows that 97% of NHIs carry excessive privileges, and 71% are not rotated within recommended time frames, which makes source-side sharing especially sensitive when credentials are used across multiple consumers. The same governance gaps that affect secrets management, offboarding, and monitoring also affect shared-data access.

This is why source-side auditability matters: the organisation must know who or what can query the dataset, when access was granted, and how quickly it can be revoked. NHIMG’s Ultimate Guide to NHIs highlights how often machine identities outnumber human ones and how frequently secrets remain exposed long enough to be exploited. Organisational risk rises when data sharing is treated as a convenience feature instead of a governed identity pathway. Organisations typically encounter the need for Delta Sharing controls only after a partner access review, credential leak, or unintended dataset exposure, at which point the term becomes operationally unavoidable to address.

Related resources from NHI Mgmt Group

• When does broad internal sharing become an insider-risk issue?
• When do SaaS sharing settings become a real security risk?
• How should security teams control SaaS data sharing risk?
• Why do SaaS sharing controls fail so often?