Identity sprawl and secret exposure are widening across enterprise NHIs

At a glance

What this is: This analysis shows that enterprise NHI sprawl, off-code secret exposure, and overprivileged AWS machine identities are all widening at the same time.

Why it matters: IAM, IGA, PAM, and NHI teams need to treat growth, visibility, and privilege as one control problem, because unmanaged machine identities expand attack surface long before anyone notices.

By the numbers:

• Entro Security reported a 44% year-over-year increase in NHI sprawl across enterprise environments.
• Entro Security found that 43% of all exposed secrets live outside code.
• Entro Security reported that 5.5% of AWS machine identities hold administrator privileges.
• Entro Security said over 2% of active secrets are more than a decade old.

Context

Identity sprawl is the growth of machine, service, and workload identities faster than the organisation can assign ownership, scope, or lifecycle control. In this article, Entro Security argues that the primary NHI governance gap is not just inventory, but the mismatch between how quickly NHIs are created and how slowly they are governed.

The article’s data combines large-scale NHI analysis with secrets exposure observations across real enterprise environments. That matters because the risk is not limited to code repositories. Secrets, permissions, and stale access now spread across CI/CD, collaboration tools, and cloud services where traditional review models are weakest.

For IAM and PAM teams, this is a governance story about drift. As NHIs accumulate, the control challenge shifts from finding identities to proving who owns them, what they can do, and whether their secrets and privileges still match operational need.

Key questions

Q: What breaks when NHI ownership is missing?

A: When NHI ownership is missing, access reviews lose context, incident response slows, and stale identities persist longer than they should. The programme may still have tools and policies, but it lacks the accountable decision path needed to execute them reliably.

Q: Why do exposed NHI secrets create more risk outside code than in code?

A: Because operational tools are where teams paste, log, forward, and share credentials during normal work. Once secrets leave the repository and appear in logs, chat, or ticketing systems, traditional code scanning no longer covers the places most likely to leak credentials.

Q: How do overprivileged machine identities increase cloud blast radius?

A: They turn a single credential into broad administrative reach. If an attacker or insider obtains one over-scoped NHI, the resulting access can span multiple services and data sets instead of being contained to a narrow workload boundary.

Q: What do security teams get wrong about least privilege in SaaS and cloud environments?

A: Teams often treat least privilege as a role design exercise when the real problem is entitlement drift across multiple identities. A user may look compliant in one platform and over-permissioned in another. Effective least privilege requires cross-platform recertification, not isolated clean-up.

Technical breakdown

Why NHI sprawl becomes a control problem

NHI sprawl is not simply a higher count of service accounts, API keys, and workload identities. It becomes a control problem when the organisation cannot tie each identity to an owner, purpose, rotation rule, or expiry condition. In cloud and SaaS environments, creation is cheap and governance is slow, so identities outlive the project, pipeline, or integration that introduced them. That is why inventory alone does not reduce risk. Without lifecycle binding, every new NHI adds another place for privilege, secrets, and trust assumptions to accumulate.

Practical implication: govern NHIs as lifecycle objects, not just assets, so ownership and expiry are enforced at creation.

Why secret exposure now extends beyond source code

Secrets exposure no longer maps cleanly to Git repositories. The article notes that a large share of exposed secrets appears in CI/CD logs, collaboration tools, and messaging platforms, which means credential leakage now follows the operational path of software delivery and support, not only the code path. This changes detection and response. Scanning code is still necessary, but it misses the places where teams paste, log, export, or share credentials during normal work. For NHIs, exposure often happens at the edges of delivery, not just at commit time.

Practical implication: extend secret detection into build logs, chat, ticketing, and project tools where operational leakage occurs.

How overprivileged AWS NHIs create silent escalation points

When a machine identity receives administrator privileges by default, the identity becomes an escalation point rather than a narrow access path. The article’s 5.5% AWS administrator figure matters because overprivilege turns compromise of one NHI into access across multiple services, datasets, or administrative functions. In practice, this is the classic blast-radius problem for machine identity governance. If privilege is broader than the workload actually needs, every secret leak, reuse event, or stale credential becomes more valuable to an attacker. Least privilege only works when entitlements are scoped to the workload’s real operating envelope.

Threat narrative

Attacker objective: The objective is to turn exposed or stale machine credentials into durable cloud access that can be expanded through excessive privilege.

1. Entry begins when attackers or insiders obtain an exposed secret from outside the code repository, including logs, collaboration systems, or messaging tools.
2. Escalation follows when that credential maps to an overprivileged NHI, especially one with administrator-level access in cloud infrastructure.
3. Impact occurs when the long-lived secret or stale identity remains active, allowing sustained access, privilege abuse, and wider compromise before governance catches up.

Breaches seen in the wild

• Hugging Face Spaces breach 2024: Unauthorised access to Hugging Face Spaces may have exposed secrets users stored for AI apps; tokens were revoked and org tokens removed.
• Microsoft Midnight Blizzard breach: Midnight Blizzard (APT29) exploited legacy test account without MFA to breach Microsoft.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

NHI sprawl is now a governance failure, not an inventory problem. The article’s core signal is that machine identity growth has outpaced the ability to assign ownership, purpose, and expiry. When NHIs multiply faster than lifecycle controls, governance becomes reactive and fragmented. The practitioner conclusion is that every new identity must carry an owner and a revocation path from day one.

Secret exposure has moved into the operational layers of delivery. CI/CD logs, collaboration tools, and messaging platforms are now part of the secret attack surface, which means repository-only controls no longer match how teams actually work. This is a classic control-boundary drift problem. The implication is that discovery, monitoring, and remediation must follow the workflow, not just the codebase.

Overprivileged machine identities create identity blast radius. A small number of AWS NHIs with administrator access can collapse the distance between a single credential leak and broad cloud compromise. That is why least privilege for NHIs is not an abstract principle but an exposure limiter. The practitioner takeaway is to treat every excessive entitlement as a multiplier on future breach impact.

Long-lived secrets expose the weakness of static trust assumptions. Active secrets that survive for years without ownership or rotation show that many programmes still assume machine access changes slowly enough to be managed later. That assumption no longer holds in high-churn cloud and SaaS estates. The conclusion for practitioners is to redesign governance around short-lived, attributable, and continuously reviewed machine access.

Ephemeral trust debt: The article exposes a growing gap between how quickly NHIs are issued and how slowly their secrets and privileges are retired. That gap is now large enough to shape breach likelihood, not just compliance posture. For identity leaders, the field should treat NHI lifecycle governance as a primary security control rather than a clean-up task after deployment.

From our research library:

• NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
• 79% of organisations have experienced secrets leaks, with 77% of these incidents resulting in tangible damage, according to the Ultimate Guide to NHIs.
• Read next: Ultimate Guide to NHIs

What this signals

Machine identity governance now needs to follow the operational surface, not just the repository. When 43% of exposed secrets live outside code, scanning only Git leaves the most common leakage paths unguarded. The next governance step is to treat collaboration, ticketing, and delivery tooling as first-class secret storage risk.

Identity blast radius is the real cost of overprivilege. A machine identity with broad cloud rights turns one leaked credential into an environment-wide problem, especially when administrator access is granted by default. Teams should use entitlement review to reduce the impact of inevitable exposure, not assume exposure can be eliminated outright.

For practitioners

• Bind each NHI to an owner and expiry condition Require a named owner, purpose, and removal trigger for every new service account, token, or workload identity before it is allowed into production.
• Expand secret discovery beyond source control Add CI/CD logs, chat platforms, ticketing systems, and project tools to secret scanning and alerting so exposed credentials are found where they are actually shared.
• Review AWS machine identities for admin scope Prioritise entitlements that grant administrator access or broad operational reach, then reduce them to the smallest permission set that still supports the workload.
• Set rotation and revocation rules for long-lived secrets Flag active secrets older than policy thresholds and tie rotation to lifecycle events such as pipeline changes, vendor offboarding, or workload retirement.
• Instrument anomaly detection for reused or reactivated identities Watch for NHI tokens used on multiple devices, stale identities that become active again, and other behavioural signals that indicate credential abuse or compromise.

Key takeaways

• The article shows that NHI growth, secret leakage, and overprivilege are happening together, which makes lifecycle governance a current control issue rather than a future programme goal.
• Its strongest evidence is operational, not theoretical: exposed secrets are appearing outside code, and a measurable share of AWS machine identities still carry administrator access.
• The practical response is to combine ownership, secret visibility, and privilege reduction so that stale machine access cannot accumulate unnoticed.

Key terms

• Identity Sprawl: Identity sprawl is the uncontrolled growth of identities, entitlements, and credentials across an environment. For NHIs, it usually appears when automation creates accounts faster than governance teams can inventory, review, and remove them. The result is hidden access, weak accountability, and a wider attack surface.
• Secrets Exposure: Secrets exposure is the accidental or uncontrolled disclosure of credentials such as API keys, tokens, certificates, and service passwords. In NHI programs, it matters because a leaked secret often behaves like a live identity, creating immediate access risk until it is revoked or rotated.
• Overprivileged Nhi: An overprivileged NHI is a service account, token, key, or other machine identity that has been granted more access than it needs to do its job. The risk is not theoretical. Excess scope increases blast radius, makes compromise more valuable to attackers, and slows containment when the identity is abused.
• Long-Lived Secret: A long-lived secret is a credential, token, API key, or certificate that remains valid for an extended period without frequent renewal. In NHI environments, it creates durable exposure because one leaked secret can keep granting access long after the original use case has changed.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.