Usage data is the evidence of how an identity actually behaves during access, such as frequency, timing, location, and the resources touched. In identity security, usage data helps distinguish active, legitimate access from dormant, excessive, or suspicious access that should be reviewed or removed.
Expanded Definition
Usage data is the operational record of how an identity behaves after it is granted access: when it authenticates, how often it is used, from where it connects, and which resources it touches. In NHI management, that evidence helps distinguish expected machine activity from dormant, over-scoped, or anomalous access. It is broader than a login log because it ties identity activity to practical authorization outcomes, not just authentication events.
For NHI programs, usage data supports entitlement review, lifecycle decisions, and anomaly detection across service accounts, API keys, workload identities, and AI agents. Its value depends on context. A token used every minute by a production workload looks normal only if its timing, source, and resource pattern match the intended service design. That is why practitioners often pair usage data with NIST Cybersecurity Framework 2.0 concepts for monitoring and access governance, while still treating the data as an identity-security signal rather than a general observability metric. Definitions vary across vendors on whether usage data includes only authentication events or also downstream API calls and resource access telemetry.
The most common misapplication is treating raw access logs as sufficient usage data, which occurs when teams fail to correlate events to a specific NHI, workload, or business purpose.
Examples and Use Cases
Implementing usage data rigorously often introduces telemetry and retention overhead, requiring organisations to weigh better access decisions against the cost of collecting, normalising, and reviewing high-volume machine activity.
- A service account used only during monthly reporting is flagged as potentially dormant when its access pattern no longer matches the expected schedule.
- An API key that suddenly begins accessing new storage buckets is reviewed because its resource-touch pattern changed outside the approved workload profile.
- An AI agent that calls external tools at unusual times is investigated for behaviour drift, especially if the agent’s permissions exceed its current task scope.
- Usage data is compared with rotation records so a credential that remains active long after expected turnover can be retired or replaced.
- Security teams correlate NHI usage with known compromise patterns described in the Ultimate Guide to NHIs — Key Research and Survey Results and validate monitoring assumptions against the NIST Cybersecurity Framework 2.0.
In practice, usage data is most useful when it answers a simple question: does this identity still need what it is using, in the way it is using it?
Why It Matters in NHI Security
Usage data is one of the few reliable ways to separate legitimate machine activity from access that persists by accident, inheritance, or compromise. Without it, dormant NHIs remain invisible, over-privileged identities keep operating, and removal decisions are made on guesswork rather than evidence. That is especially dangerous because NHI Mgmt Group reports that only 5.7% of organisations have full visibility into their service accounts, which means most environments lack a complete view of how non-human identities are actually being used.
When usage data is managed well, it supports Zero Standing Privilege, reduces unnecessary entitlements, and improves offboarding decisions for workloads, keys, and automation. When it is missing or ignored, teams tend to discover the problem only after an incident, a failed audit, or an unexpected dependency outage. At that point, usage data becomes operationally unavoidable because it is the evidence needed to prove what should stay, what should be revoked, and what was abused.
Organisations typically encounter usage-data gaps only after a suspicious access event or failed revocation, at which point the term becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and OWASP Agentic AI Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST Zero Trust (SP 800-207) and NIST SP 800-63 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-07 | Usage evidence underpins review of dormant and overused non-human identities. |
| NIST CSF 2.0 | DE.CM | Continuous monitoring relies on behavior evidence to spot anomalous identity activity. |
| NIST Zero Trust (SP 800-207) | PA | Zero Trust decisions depend on observed identity behavior and contextual verification. |
| NIST SP 800-63 | AAL2 | Assurance is not just issuance; ongoing use evidence helps validate authentic activity. |
| OWASP Agentic AI Top 10 | A9 | Agent activity must be observed to detect tool abuse and behavior drift. |
Collect and review NHI usage to remove stale access and validate that activity matches intended service purpose.
Related resources from NHI Mgmt Group
- How should teams manage SaaS renewals when usage data is incomplete?
- What breaks when renewal decisions are made without usage data?
- How do teams know if license usage data is actually useful for IAM decisions?
- How do organisations know whether SaaS usage data is good enough for governance decisions?
