A detection approach that correlates applications and accounts back to known identities, domains, and business context. It is more effective than traffic-only monitoring when the question is whether an account actually exists and who is responsible for its access and lifecycle.
Expanded Definition
Identity-first discovery is a detection method that starts with known identities, accounts, domains, service principals, and business context, then maps those entities back to applications and infrastructure. In NHI operations, that means asking not only what traffic exists, but which NIST Cybersecurity Framework 2.0 style assets are actually owned, entitled, and governed.
Usage in the industry is still evolving because some teams treat discovery as asset inventory while others use it as identity correlation for lifecycle control. NHIMG treats the latter as the more useful NHI security lens: the goal is to connect an API key, certificate, or service account to the workload and owner responsible for its issuance, rotation, and retirement. That distinction matters because a traffic-only sensor can see communication, but it cannot reliably determine whether an identity is legitimate, orphaned, overprivileged, or duplicated across environments. Identity-first discovery also helps separate human-owned access from machine-owned access, which reduces confusion during reviews and incident response.
The most common misapplication is relying on network telemetry alone, which occurs when teams try to infer identity ownership from flows without reconciling accounts, directories, and deployment records.
Examples and Use Cases
Implementing identity-first discovery rigorously often introduces correlation overhead, requiring organisations to balance broader visibility against the time needed to normalise identity data across tools and teams.
- Security teams ingest directory and cloud IAM records, then map each service account to its application owner and rotation policy, using NHI Lifecycle Management Guide as a reference for lifecycle ownership.
- Platform engineers identify GitHub tokens, CI/CD secrets, and workload certificates tied to a specific repository or deployment pipeline, rather than treating them as anonymous credentials, a pattern also reflected in JetBrains GitHub plugin token exposure.
- Incident responders correlate an unexpected outbound connection to the account that initiated it, then verify whether the identity existed in the approved inventory and whether it had a valid business purpose.
- Governance teams use identity-first discovery to find accounts that appear in cloud logs but not in the authoritative directory, which helps expose shadow NHIs and stale access paths described in the 52 NHI Breaches Analysis.
- Architecture teams compare workload metadata, ownership tags, and entitlement records to avoid mistaking a shared runtime account for a single application identity.
When applied well, the method turns discovery into an ownership question: who created this identity, what does it touch, and when should it be removed?
Why It Matters in NHI Security
Identity-first discovery closes a major blind spot in NHI governance because many organisations can observe activity but cannot confidently explain who owns the identity behind it. That gap matters when secrets are leaked, service accounts proliferate, or a certificate is deployed outside approved channels. NHIMG reports that only 5.7% of organisations have full visibility into their service accounts, and that lack of visibility makes identity-based inventory essential rather than optional. Without it, teams can miss orphaned accounts, duplicated credentials, and overprivileged machine access that survive long after the original workload has changed.
This approach also supports better Zero Trust enforcement by tying access decisions to explicit identity context instead of implicit network trust. It aligns with guidance in Ultimate Guide to NHIs and helps surface patterns discussed in Top 10 NHI Issues, especially excess privilege and weak lifecycle control. In practice, the value becomes obvious after an incident forces reconstruction of ownership, because then discovery is no longer about visibility alone but about proving which identities should have existed at all.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and OWASP Agentic AI Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST Zero Trust (SP 800-207) and NIST SP 800-63 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 | Identity-first discovery supports finding and inventorying NHIs by ownership and context. |
| NIST CSF 2.0 | ID.AM | Asset management requires knowing which identities and supporting assets exist in the environment. |
| NIST Zero Trust (SP 800-207) | PA | Policy enforcement depends on identity context, not just observed network activity. |
| NIST SP 800-63 | IAL | Identity proofing concepts inform how confidently an account can be linked to a real owner. |
| OWASP Agentic AI Top 10 | A3 | Agentic systems need discovery of identities with tool access and execution authority. |
Build an authoritative NHI inventory that links each machine identity to owner, purpose, and lifecycle state.
