NHI and secrets risk is widening as exposed identities outnumber humans

At a glance

What this is: This report tracks how NHI growth and exposed secrets are widening the attack surface, with machine identities now far exceeding human accounts and risky secrets appearing outside code.

Why it matters: IAM, PAM, and NHI teams need to treat machine identity inventory, ownership, and privilege scope as core governance controls because exposure is spreading beyond developer workflows.

By the numbers:

• Non-human identities now outnumber humans 144:1 in the report’s H1 2025 snapshot.

Context

The core problem is not simply that more secrets exist. It is that non-human identities are expanding faster than the governance model built to own, review, and retire them, while exposed secrets increasingly appear in places where normal developer controls do not see them.

In practical terms, this is a lifecycle problem across NHI inventory, secret visibility, and privilege scope. Vaulting helps, but it does not solve ownership gaps, unmanaged shadow identities, or machine accounts that remain active after their purpose has expired.

Key questions

Q: What breaks when secrets are still stored outside managed vaults?

A: Secrets become easy to reuse across humans, scripts, and agents without a consistent audit trail. That increases the chance of exposure, weakens revocation, and makes it unclear which identity used the credential. A vault is only useful if it is the normal access path, not an optional store.

Q: Why do over-privileged identities increase breach impact?

A: Over-privileged identities expand the damage a stolen credential can do because the attacker inherits more pathways into sensitive systems. Excess access also makes lateral movement easier and makes containment harder. In practice, every unnecessary entitlement becomes part of the attacker’s available blast radius.

Q: How can organisations tell whether NHI governance is actually working?

A: NHI governance is working when every machine identity has an owner, a purpose, a minimum-necessary entitlement, and evidence of rotation and review. If teams can produce that chain without manual reconstruction, the programme is mature enough to withstand audit pressure. If they cannot, the governance model is still fragmented.

Q: What is the difference between secret rotation and NHI offboarding?

A: Rotation changes the credential while the identity stays active. Offboarding removes the identity or proves it is no longer needed. Teams often confuse the two and rotate obsolete credentials instead of retiring them. Good governance uses both, but offboarding is what eliminates unused access and reduces long-term attack surface.

Technical breakdown

Why NHI sprawl changes the control plane

Non-human identities are service accounts, API keys, tokens, certificates, and workload credentials that act independently of a human login session. When they multiply faster than inventory and offboarding, the control plane becomes stale by design: access reviews lag reality, owners disappear, and permissions accumulate without a reliable business owner to certify them. That is why NHI security fails first at lifecycle discipline, not at authentication syntax. The report’s 144:1 ratio is a signal that machine identities are now a dominant population, not an edge case.

Practical implication: Treat NHI inventory and ownership as first-order governance data, not an audit afterthought.

Why exposed secrets outside code are harder to govern

Secrets exposed outside code usually sit in collaboration tools, files, messaging, screenshots, tickets, or exported artifacts. Those locations sit outside the traditional source-control and CI security workflow, so scanning code alone leaves a large blind spot. The issue is not only leakage, but persistence: once a secret appears in an unmanaged location, discovery, revocation, and validation become separate tasks that often involve different teams. This is why detection without coordinated revocation creates a false sense of control.

Practical implication: Extend secret discovery beyond repositories into collaboration, endpoint, and file-sharing paths.

Why overprivileged machine identities magnify blast radius

A machine identity with full admin privileges turns a single credential into a systemic control failure. In cloud environments, privilege scope determines whether a leaked key is a nuisance or a platform-wide compromise path. Overprivilege matters because machines do not need persuasion or social engineering to exercise rights already granted to them. When the report highlights AWS machine identities carrying full admin privileges, it is pointing to an entitlement problem, not just a secret management problem.

Practical implication: Reduce standing privilege on machine identities before rotating anything else.

Threat narrative

Attacker objective: The attacker wants durable access through machine credentials that outlive their intended owner and provide excessive reach across cloud and SaaS environments.

1. Entry begins when a secret is exposed in a non-code location such as a file, collaboration platform, or messaging tool, placing the credential outside the normal developer security workflow.
2. Credential access follows because the secret can be copied and reused without needing to break the underlying system that issued it.
3. Escalation occurs when that credential belongs to an overprivileged machine identity, especially one with broad cloud permissions or admin rights.
4. Impact is achieved when the stolen or forgotten credential is used to access systems, move laterally, or maintain access longer than the original owner intended.

Breaches seen in the wild

• Moltbook AI agent keys breach: Moltbook breach exposed 1.5M AI agent keys.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Secrets management has become a governance problem, not just a vaulting problem. The report shows exposed secrets appearing outside code, which means source-control scanning and vault adoption no longer cover the full exposure surface. The more important question is whether organisations can see where credentials actually live, who owns them, and whether they are still valid. Practitioners should treat secret visibility as a lifecycle control spanning code, collaboration, and endpoint environments.

Machine identity sprawl is now large enough to invalidate human-centric identity assumptions. Human IAM programmes assume a manageable number of reviewable accounts, but the report’s 144:1 ratio makes that assumption brittle. Non-human identities do not fit annual review cadence, owner-based certification rituals, or manual cleanup at enterprise scale. The implication is that identity governance has to distinguish between human review processes and machine identity lifecycle control.

Overprivileged AWS machine identities represent identity blast radius, not isolated misconfiguration. When a machine identity has full admin privileges, the issue is not merely one bad role assignment. It is a compounded exposure pattern in which secret leakage, privilege excess, and weak offboarding combine into a reusable compromise path. The practitioner takeaway is to measure how much damage any single machine credential can do before focusing on volume.

Real-time detection is becoming the minimum viable control for secret exposure. The report’s theme of “real-time or bust” reflects a structural change in how quickly NHI risk turns operational. If exposed secrets can persist in unmanaged places, then point-in-time audits are too slow to contain the blast radius. Security teams need to know where signal comes from, how fast it reaches revocation, and which identities remain active after exposure.

Ephemeral secret trust debt: The article’s underlying pattern is that organisations keep treating secrets as if exposure is temporary when, in practice, reuse and delayed revocation make them durable liabilities. That debt accumulates across SaaS, collaboration, and cloud workflows, and the longer it persists, the more the identity programme depends on luck rather than governance. Practitioners should assume every exposed secret increases future containment cost until it is revoked and offboarded.

From our research library:

• NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
• Read next: Ultimate Guide to NHIs

What this signals

Machine identity governance now has to start with inventory, not optimization. Once non-human identities outnumber humans at this scale, the operational question changes from how to secure a credential to how to maintain a trustworthy population of identities at all. Owners, purpose, and expiry become the minimum viable metadata for control.

Secrets exposure is migrating into collaboration workflows. That shift means repository security alone is no longer a sufficient control boundary. Practitioners need to think in terms of where secrets can be copied, shared, and reused across SaaS, files, and chat systems before revocation ever starts.

For practitioners

• Inventory machine identities by owner and privilege Build a current register of service accounts, API keys, tokens, and certificates with explicit ownership and business purpose. Flag identities with no owner, no expiry, or no documented use case.
• Expand secret discovery beyond source code Search collaboration platforms, shared files, tickets, endpoints, and messaging systems for exposed credentials, not just repositories and CI logs. Prioritise locations where secrets can be copied without triggering developer controls.
• Remove full admin rights from machine identities Review cloud roles attached to machine identities and replace standing admin access with task-scoped permissions. Focus first on identities that can modify security groups, IAM policy, or key material.
• Pair detection with mandatory revocation Define a revocation workflow that starts when a secret is detected outside approved storage and ends only when the credential is invalidated everywhere it can still be used. Measure the gap between exposure and revocation.
• Segment NHI cleanup from human access review Use a separate governance workflow for NHI offboarding, since machine credentials can remain active long after their original purpose ends. Do not rely on the same review cadence used for human users.

Key takeaways

• The report describes a control environment where machine identities, exposed secrets, and privilege scope are expanding faster than traditional IAM review cycles can absorb.
• Its strongest warning is that secrets no longer stay confined to code, which pushes discovery and revocation into collaboration and file-sharing channels.
• Security teams need separate lifecycle governance for NHIs because ownership, visibility, and offboarding are now the controls that reduce blast radius.

Key terms

• Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
• Secrets Exposure: Secrets exposure is the accidental or uncontrolled disclosure of credentials such as API keys, tokens, certificates, and service passwords. In NHI programs, it matters because a leaked secret often behaves like a live identity, creating immediate access risk until it is revoked or rotated.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
• NHI Offboarding: NHI offboarding is the controlled removal or reassessment of machine credentials when business ownership changes, work ends, or a system is retired. It extends human offboarding concepts to secrets, tokens, certificates, and service accounts that can otherwise remain active indefinitely.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.