A control model where credentials are created on demand, scoped to a task, and removed or invalidated when the task ends. It shifts secret handling from static storage to lifecycle orchestration, which is essential in distributed and multi-cloud environments.
Expanded Definition
Dynamic secrets management is the practice of issuing credentials only when a workload, service, or agent needs them, then revoking or expiring those credentials as soon as the task ends. In NHI operations, this shifts risk away from long-lived secrets stored in config files, vaults, and CI/CD variables, and toward controlled lifecycle orchestration.
Definitions vary across vendors on how much automation is required, but the security intent is consistent: reduce secret dwell time, shrink blast radius, and remove the human habit of reusing static credentials. NHI Management Group treats dynamic secrets as a lifecycle control, not just a vault feature, because the operational value comes from issuance policy, scoping, rotation, and revocation working together. For background on lifecycle design, see the Ultimate Guide to NHIs — Lifecycle Processes for Managing NHIs and the Ultimate Guide to NHIs — Static vs Dynamic Secrets. A useful external reference for the broader control objective is the OWASP Non-Human Identity Top 10.
The most common misapplication is treating a short-lived token as “dynamic” even when it is issued from a static parent secret that remains broadly exposed.
Examples and Use Cases
Implementing dynamic secrets rigorously often introduces orchestration overhead, requiring organisations to weigh tighter control against platform complexity and dependency on reliable automation.
- A CI/CD runner requests a database credential for a single deployment job, then loses access when the job completes, limiting reuse if the pipeline is compromised.
- A Kubernetes workload uses ephemeral cloud credentials minted at runtime, so the application never stores a long-lived API key in an image, secret mount, or environment variable.
- A database session is created with a task-specific role and a short TTL, then revoked automatically after the workload exits, reducing lateral movement risk.
- A secrets platform issues a one-time token for an agent to call an internal service, aligning with the lifecycle guidance in Ultimate Guide to NHIs — Lifecycle Processes for Managing NHIs.
- Security teams use patterns from the Guide to the Secret Sprawl Challenge to replace scattered static secrets with issuance workflows that fit the NIST Cybersecurity Framework 2.0 guidance on access control and recovery.
Why It Matters in NHI Security
Dynamic secrets matter because compromise of one credential should not become a persistent foothold. In non-human environments, secrets are often copied across pipelines, orchestration layers, and service meshes, which makes static credentials especially dangerous. When issuance and revocation are automated, defenders can limit how long an attacker can use stolen access and how far that access can spread.
NHIMG research shows that 88% of security professionals are concerned about secrets sprawl, and 54% say they are dissatisfied with their current secrets management solution because not all secrets are secured, according to The 2024 State of Secrets Management Survey. That concern is not theoretical. Breaches and supply chain incidents often expose static credentials in repos, build logs, and deployed workloads, which is why the Shai Hulud npm malware campaign is a useful reminder of how quickly secrets can be harvested once they are embedded in developer workflows. For governance alignment, the Top 10 NHI Issues and the OWASP NHI guidance both frame secret lifecycle control as a core defense, not an optional hardening step.
Organisations typically encounter the true cost of dynamic secrets only after a leaked credential is found in a pipeline or production workload, at which point revocation speed becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and CSA MAESTRO address the attack and risk surface, while NIST CSF 2.0, NIST Zero Trust (SP 800-207) and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 | Dynamic issuance and revocation directly address improper secret management. |
| NIST CSF 2.0 | PR.AC-1 | Identity and access controls govern how non-human credentials are issued and limited. |
| NIST Zero Trust (SP 800-207) | IA | Zero Trust assumes credentials must be continuously validated and tightly scoped. |
| NIST AI RMF | AI systems using agents need controlled, revocable access to downstream tools and data. | |
| CSA MAESTRO | Agentic workflows require ephemeral privileges to constrain tool and data exposure. |
Apply least privilege to workload credentials and automate removal when access is no longer needed.
