An SSH key inventory is a complete record of keys that exist, where they are used, and who or what owns them. It gives security teams the baseline needed to find orphaned, shared, or stale keys. Without that inventory, access reviews and rotation efforts are usually incomplete and unreliable.
Expanded Definition
ssh key inventory is the disciplined discovery and tracking of SSH public and private key pairs across servers, automation jobs, developer workstations, and administrative jump paths. In NHI security, the inventory is not just a list of files or fingerprints. It is a lifecycle record that ties each key to an owner, system, scope of use, creation date, last rotation, and revocation status.
This matters because SSH keys often function as long-lived machine identities with broad trust. A complete inventory supports least privilege, offboarding, rotation, and exception handling, while also exposing duplicate keys, unmanaged keys, and keys embedded in scripts or image builds. Guidance varies across vendors on how much metadata should be stored, but the operational goal is consistent: enough context to answer who can authenticate, where, and under what conditions. The NIST Cybersecurity Framework 2.0 is a useful reference for the broader governance expectation around asset visibility and access control, even though it does not define SSH inventories as a standalone control.
The most common misapplication is treating SSH key inventory as a one-time audit artifact, which occurs when teams collect fingerprints but fail to maintain ownership and rotation status as systems change.
Examples and Use Cases
Implementing SSH key inventory rigorously often introduces administrative overhead, requiring organisations to balance faster operational access against tighter identity governance and review discipline.
- A platform team maps every SSH key used for GitOps deployers to a named service account so expired access can be removed without breaking release pipelines.
- A security team compares inventory records with server authorized_keys files to find orphaned keys left behind after contractor offboarding.
- An infrastructure group uses inventory data to identify shared administrator keys that should be replaced with per-user or per-system identities.
- A compliance team links key owners and rotation dates to access review workflows so stale credentials are flagged before an audit.
- After reviewing the risks in the Ultimate Guide to NHIs, an engineering team adds SSH keys into the same governance process used for other non-human identities.
For operational guidance on access visibility and control mapping, teams often align inventory work with the NIST Cybersecurity Framework 2.0, especially when inventories are used to support asset management and access governance.
Why It Matters in NHI Security
SSH keys are high-value credentials because they frequently outlive the systems and people that introduced them. Without inventory, organisations cannot confidently answer whether a key is still needed, where it is deployed, or whether it grants privileged access to production systems. That uncertainty creates hidden persistence paths for attackers and makes key rotation incomplete by default.
NHI Mgmt Group research shows that only 5.7% of organisations have full visibility into their service accounts, and 71% of NHIs are not rotated within recommended time frames. Those numbers illustrate a broader visibility gap that also affects SSH keys when they are managed as ad hoc files rather than governed identities. An inventory is the control foundation that turns key sprawl into something reviewable, revocable, and auditable. It also supports Zero Trust patterns by making trust relationships explicit instead of assumed.
Organisations typically encounter the cost of missing SSH inventory only after a breach, failed rotation, or audit finding exposes long-forgotten keys, at which point the inventory becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and OWASP Agentic AI Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST Zero Trust (SP 800-207) and NIST SP 800-63 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 | SSH key sprawl is a core NHI inventory and secret governance problem. |
| NIST CSF 2.0 | ID.AM | Asset management requires knowing where credential assets exist and how they are used. |
| NIST Zero Trust (SP 800-207) | AC-4 | Zero Trust depends on explicit, continuously verified access relationships for machine identities. |
| NIST SP 800-63 | Digital identity guidance supports assurance, lifecycle, and binding of authenticators. | |
| OWASP Agentic AI Top 10 | Agentic systems often rely on SSH keys for tool and infrastructure access. |
Inventory SSH keys used by agents and automation so delegated execution remains attributable and revocable.
