How do you know if NHI access certification is actually working?

A working programme reduces orphaned, idle, exposed, and over-permissioned credentials while producing clear decision logs for every case. If campaigns only create activity but do not change credential state, ownership clarity, or revocation rates, the control is not governing risk.

Why This Matters for Security Teams

NHI access certification is supposed to prove that credentials, service accounts, API keys, and tokens are still needed, still owned, and still limited to the right scope. When it is working, the programme changes the state of access. When it is not, it becomes a reporting exercise that looks complete while orphaned and over-permissioned access keeps accumulating. The practical question is whether review outcomes actually drive revocation, rotation, and ownership correction.

This is why NHI governance has to be measured differently from human access reviews. Non-human identities are not reviewed on a quarterly rhythm because they are static. They often power CI/CD, data pipelines, integrations, and automation that never sleeps. NHIMG research shows that 97% of NHIs carry excessive privileges, and only 20% of organisations have formal offboarding and revocation processes for API keys in place, which makes weak certification campaigns easy to miss until an incident forces the issue. See the broader risk context in the Ultimate Guide to NHIs and the attack patterns documented in 52 NHI Breaches Analysis.

Current guidance from the OWASP Non-Human Identity Top 10 and NIST SP 800-53 Rev 5 Security and Privacy Controls reinforces that access governance must produce enforceable outcomes, not just approvals. In practice, many security teams discover that certification was only producing spreadsheet closure after a credential misuse event has already exposed the control gap.

How It Works in Practice

A working NHI access certification programme should leave a measurable trail from review decision to enforcement. That means every reviewed credential should end with one of a small set of outcomes: confirmed ownership, reduced scope, rotated secret, disabled account, revoked token, or documented exception with expiry. If the campaign cannot show those changes in systems of record, it is not functioning as a governance control.

The best programmes use identity inventory, ownership metadata, and usage telemetry together. Reviewers should not be asked to approve anonymous entries. They need to see who owns the credential, what workload uses it, when it last authenticated, what systems it touches, and whether the access is still aligned to a business purpose. The Ultimate Guide to NHIs — Key Challenges and Risks is useful here because it frames why visibility, rotation, and offboarding must be connected rather than treated as separate tasks.

• Measure revocation rate, not campaign completion rate.
• Track how many items are reassigned from unknown to known ownership.
• Compare pre-review and post-review privilege scope to confirm reduction.
• Verify that expired approvals trigger automated removal or rotation.
• Check whether unused or dormant credentials are actually disabled.

Use review evidence from logs, secret managers, PAM, CI/CD systems, and cloud IAM to confirm that decisions were executed. NIST guidance on control monitoring supports this outcome-oriented approach, while OWASP’s NHI guidance helps define the specific risks of secrets that remain valid long after they should have been removed. These controls tend to break down in highly distributed environments with shadow automation because ownership data is incomplete and enforcement systems are not integrated with the review workflow.

Common Variations and Edge Cases

Tighter certification often increases operational overhead, so organisations have to balance stronger enforcement against review fatigue and tooling complexity. That tradeoff is real, especially where thousands of short-lived service accounts, pipeline credentials, and third-party integrations change faster than a quarterly campaign can keep up with.

Best practice is evolving for ephemeral and highly automated estates. There is no universal standard for whether every short-lived token needs manual certification, but current guidance suggests that runtime controls, usage thresholds, and exception handling should replace blanket human review when credentials are issued per task or per deployment. In those environments, a certification programme should validate the policy and the issuing process, not just the individual secret.

Edge cases also matter. Shared credentials can create false positives if ownership is intentionally pooled, while machine-to-machine integrations may appear idle simply because they run on schedule rather than interactively. That is why metrics like “percentage reviewed” are weak on their own. Stronger signals are “percentage of credentials with verified owner,” “percentage of high-risk access removed,” and “percentage of exceptions that expired on time.” The Ultimate Guide to NHIs and the OWASP Non-Human Identity Top 10 both point to the same operational reality: if access review cannot force cleanup, the risk simply reappears in the next cycle.

Related resources from NHI Mgmt Group

• How do you know if Oracle access governance is actually working?
• How do you know if AI access controls are actually working?
• How do you know if NHI governance is actually working?
• How do you know if NHI rotation and offboarding are actually working?