NHI risk is shifting from credential theft to privilege blast radius

At a glance

What this is: This brief argues that NHI risk is shifting from stolen credentials to the privilege scope those identities carry, with over-privileged entitlements driving blast radius.

Why it matters: IAM, PAM, and cloud security teams need to treat entitlement scope and ownership as the primary control points for service accounts, workload identities, and AI-adjacent NHIs.

By the numbers:

• Non-Human Identities outnumber human users anywhere from 45:1 to 100:1 in cloud environments.
• 95% of cloud identities are over-privileged.

Context

NHI risk is the exposure created when service accounts, workload identities, API keys, tokens, and certificates accumulate privileges faster than they are governed. In cloud and DevOps environments, that gap is often wider than teams expect because the identity exists for a workload, not a person, so the usual human IAM assumptions do not apply.

Andromeda Security's brief frames the central problem as privilege blast radius rather than credential theft alone. That distinction matters because a stolen secret is only the entry point; the permissions attached to the identity determine how far an attacker can move and what systems they can reach.

The article also ties the issue to lifecycle ownership, noting that NHIs are often created by developers, vendors, or automation processes and then left behind when those relationships change. That makes discovery, accountability, and entitlement review the real governance bottlenecks.

Key questions

Q: What breaks when non-human identities have more access than they need?

A: When non-human identities carry excess access, a single compromise can move from a local incident to broad cloud control. Over-privileged service accounts, tokens, and AI agents can reach storage, compute, and IAM functions that were never necessary for their job. The result is larger blast radius, faster lateral movement, and much harder containment.

Q: Why do NHIs create a larger breach blast radius than human accounts?

A: NHIs often have persistent access, broad scopes, and machine-speed reach across many systems, so one compromise can affect multiple datasets quickly. Unlike human users, they are frequently created for automation and then left in place with minimal review. That makes their effective access harder to see and easier for attackers to turn into large-scale data theft.

Q: How can organisations tell whether NHI governance is actually working?

A: NHI governance is working when every machine identity has an owner, a purpose, a minimum-necessary entitlement, and evidence of rotation and review. If teams can produce that chain without manual reconstruction, the programme is mature enough to withstand audit pressure. If they cannot, the governance model is still fragmented.

Q: What should teams do when an NHI credential is compromised?

A: Contain the identity first by revoking or rotating the credential, then immediately review the permissions attached to that account and remove any standing access that exceeds the workload's actual need. Without scope reduction, the same compromise can be reused elsewhere.

Technical breakdown

Why over-privileged NHIs turn one stolen credential into broad access

A non-human identity becomes dangerous when its permissions exceed the minimum needed for the workload it supports. If an attacker acquires a secret for that identity, they inherit every action the entitlements allow, which can include data access, infrastructure changes, or lateral movement into adjacent services. This is why the article focuses on blast radius: the credential is the entry mechanism, but the authorization scope defines the damage. In practice, over-privilege is a compound control failure because it combines weak scoping, poor discovery, and stale permissions that persist after business need has changed.

Practical implication: reduce standing entitlements before the credential is exposed, not after it is stolen.

Why NHI credential governance is weaker than human identity governance

Human identity programmes usually have MFA, lifecycle checkpoints, and centralized ownership through HR-linked processes. NHIs do not. They are frequently created in code, pipelines, or cloud consoles, then reused across workloads without the same review cadence or lifecycle anchor. Secrets such as API keys, access keys, tokens, and certificates can therefore remain long-lived and difficult to trace back to a sponsor. The operational issue is not just secret hygiene; it is the absence of an authoritative system of record that tells teams what exists, who owns it, and whether it should still be active.

Practical implication: build inventory and ownership into NHI governance before trying to optimise rotation cadence.

Why entitlement right-sizing matters more than rotation alone

Rotation changes the credential, but it does not change the scope of access that credential unlocks. If a service account or workload identity is still permitted to read, write, or administer too many resources, a refreshed secret still gives an attacker broad reach after compromise. The article's recommendation to shift rarely used privileges to Just-in-Time elevation points to the real mechanism: reduce default reach and make elevated action temporary. That is a privilege architecture problem, not a secrets-only problem.

Practical implication: pair rotation with entitlement reduction, or you preserve the same blast radius with a newer secret.

Threat narrative

Attacker objective: The attacker aims to turn one compromised non-human identity into broad, low-friction access that enables lateral movement, data exposure, and operational disruption.

1. Entry occurs when an attacker obtains an NHI credential such as an API key, access key, token, or certificate through theft, leakage, or reuse. The article treats these secrets as the initial access path into cloud workloads and service environments.
2. Escalation follows when the compromised identity has excessive permissions, letting the attacker perform actions far beyond the workload's real business need. The blast radius is defined by entitlement scope, not by the secret itself.
3. Impact comes from lateral movement, broader cloud access, compliance exposure, and operational disruption once the attacker uses those privileges to reach additional systems and data. The article explicitly ties NHI compromise to business continuity and cloud cost risk.

Breaches seen in the wild

• Scania insurance portal breach 2025: An attacker used an external user login, likely stolen by infostealer malware, to take insurance claim documents from a Scania portal.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Blast-radius control is now the primary NHI security problem: once NHIs are numerous, ephemeral, and widely distributed, credential theft becomes less important than the permissions attached to the identity. A stolen secret is only the entry point; over-privileged entitlements decide whether the event stays local or becomes enterprise-wide. The practitioner conclusion is straightforward: governing scope matters more than governing secret format.

NHI governance fails when teams inherit human IAM assumptions: human programmes assume MFA, central lifecycle control, and sponsor visibility, but NHIs are created in cloud and DevOps flows without those anchors. That assumption breaks because service accounts and workload identities can exist outside HR-linked governance while still carrying production privileges. The implication is that identity governance for NHIs needs its own inventory, ownership, and recertification discipline.

Privilege excess is the real blast-radius multiplier: Andromeda Security's own 95% over-privileged figure reinforces the point that most cloud identities carry more access than they need. That creates a compounding exposure model in which every compromised NHI becomes a potential bridge into adjacent systems. Practitioners should treat entitlement minimisation as a containment control, not a hygiene project.

Dynamic least privilege is more important than static rotation: secret rotation can reduce exposure time, but it does not address the access graph created by standing entitlements. The article's recommendation to move rarely used privileges to Just-in-Time elevation is a signal that access scope, not secret age, is the dominant control variable. The practitioner conclusion is to redesign privileged reach, not just renew credentials.

Ownership without lifecycle offboarding leaves orphaned machine access in place: the article's emphasis on human sponsorship shows that NHIs need an accountable owner across creation, use, and retirement. When that ownership breaks, the identity often outlives the business process that justified it, leaving dormant privilege behind. The practitioner implication is to make offboarding and decommissioning part of NHI governance, not an afterthought.

From our research library:

• NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
• Read next: Ultimate Guide to NHIs — Key Challenges and Risks

What this signals

Privilege blast radius is the better control lens for NHI programmes: teams that still focus mainly on secret rotation are solving the symptom, not the exposure model. The operating question is which entitlements a compromised identity can reach, because that determines whether a leak stays contained or becomes a cloud-wide incident.

Access reviews designed for humans do not fully solve NHI risk because the identity may be created, used, and retired inside machine workflows that move faster than certification cycles. NHI governance has to move closer to issuance and entitlement design, or the review will always arrive after the useful window has passed.

The strongest programmes will treat NHI ownership as a lifecycle discipline, not a tooling task. That means connecting discovery, sponsorship, entitlement right-sizing, and offboarding into one control chain instead of leaving each step to a different team.

For practitioners

• Map every NHI to an accountable owner Create a complete inventory of service accounts, workload identities, API keys, tokens, and certificates, and bind each to a human sponsor who can approve retirement or scope changes.
• Right-size entitlements by actual usage Review the permissions attached to each NHI and remove unused or excessive access, especially where standing privileges are broader than the workload requires.
• Shift rarely used privileges to Just-in-Time elevation Reserve elevated access for exceptional actions and make the default permission set intentionally small so a stolen credential cannot automatically open high-impact paths.
• Track orphaned NHIs during offboarding Add NHI decommissioning to employee, vendor, and process exit checks so accounts do not remain active after the sponsor or business need is gone.
• Use behavioural monitoring for anomalous NHI activity Watch for unusual access patterns, unexpected resource calls, and privilege use outside normal workload behaviour, then trigger revocation or key rotation when anomalies appear.

Key takeaways

• The article's core warning is that NHI exposure is driven by privilege scope, not credential theft alone.
• Andromeda Security says NHIs can outnumber human users by 45:1 to 100:1 in cloud environments, which makes unmanaged entitlement growth a scale problem, not an edge case.
• The practical response is to inventory NHIs, remove excess access, and enforce ownership so one compromised identity cannot fan out across the environment.

Key terms

• Blast Radius: The potential scope of damage if a specific credential or identity is compromised. Identities with broad permissions have a larger blast radius and represent a higher priority for least-privilege enforcement and security controls.
• Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
• Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.
• Just-in-Time Elevation: A temporary access pattern that grants a user or system elevated permissions for a limited period. It reduces exposure compared with always-on privilege, but it does not necessarily remove the underlying role or account from the environment, so governance must still address the residual entitlement path.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.