NHI security needs a governance model, not just secret rotation

At a glance

What this is: This is an analysis of why NHI security needs unified discovery, governance, and enforcement rather than isolated secret rotation, with the key finding that most organisations still cannot fully inventory their NHI estate.

Why it matters: It matters because IAM, IGA, and PAM teams are now responsible for machine identities that outnumber human users, create persistent attack paths, and often sit outside lifecycle and review processes designed for people.

By the numbers:

• Only 5.7% of organizations report being able to accurately inventory all NHIs in their environment.
• 80% of NHIs have high or critical posture issues that expose them to common attack techniques.

👉 Read Silverfort's analysis of NHI governance, posture, and runtime enforcement

Context

NHI governance is the discipline of discovering, controlling, and enforcing policy across service accounts, API keys, OAuth tokens, certificates, and other machine identities. This article argues that secrets management alone does not solve the larger problem because the estate is fragmented, long-lived, and often unmanaged.

The primary gap is structural: enterprise identity programmes were built for people, while NHIs operate across cloud platforms, SaaS, DevOps tooling, and AI workflows without joiner-mover-leaver coverage or human-style control points. That makes unified inventory, owner mapping, posture analysis, and runtime enforcement the real governance baseline for NHI security.

Key questions

Q: How should teams reduce the risk from exposed NHI secrets?

A: Teams should combine secret discovery, immediate revocation, enforced rotation, and tighter access controls around repositories, logs, and collaboration tools. The core challenge is that detection alone does not close the window of abuse, so remediation workflows need to move faster than attacker reuse patterns.

Q: Why are NHIs harder to govern than human identities?

A: NHIs are often hidden in code, automation tools, and infrastructure configurations and lack centralised ownership. They can be created automatically by pipelines and infrastructure-as-code without formal registration. They rarely have a designated owner, may not appear in IAM dashboards, and do not expire when the project that created them is disbanded.

Q: What do security teams get wrong about secret rotation?

A: They often treat rotation as a substitute for removing the underlying credential model. Rotation lowers exposure time, but it still leaves a secret to steal, bootstrap, and govern. If a workload can avoid holding the secret at all, that is a stronger control than simply changing it more often.

Q: How can organisations tell whether NHI governance is actually working?

A: NHI governance is working when every machine identity has an owner, a purpose, a minimum-necessary entitlement, and evidence of rotation and review. If teams can produce that chain without manual reconstruction, the programme is mature enough to withstand audit pressure. If they cannot, the governance model is still fragmented.

Technical breakdown

Why static NHI credentials create persistent exposure

Static credentials are durable by design, which makes them operationally convenient and security-expensive. Service accounts, tokens, and API keys often remain valid across multiple systems and are reused to keep automations running, which turns a single exposed credential into a standing path to privileged access. The problem is not just leakage. It is that the credential can survive long after the business need changed, and it may exist in repositories, logs, CI/CD artifacts, or SaaS integrations where conventional IAM visibility is weak.

Practical implication: treat long-lived NHI credentials as exposure-prone assets, not just authentication artifacts.

How fragmented identity graphs hide NHI risk

Hybrid and multi-cloud environments create separate control planes for cloud identity providers, SaaS apps, infrastructure, and DevOps systems, so the same NHI can be created, used, and forgotten in different places. A unified identity graph is the only way to correlate ownership, privilege, usage, and exposure across those systems. Without that correlation, posture tools see isolated objects instead of the relationships that define blast radius and remediation priority. Fragmentation is why many NHI programmes know a secret exists but cannot say who owns it or where it is active.

Practical implication: build a unified inventory before attempting posture management or enforcement.

Why runtime enforcement matters after visibility and remediation

Visibility and remediation reduce risk only if the organisation can also constrain behaviour at the moment of use. Runtime enforcement applies policy at authentication or request time, such as location-based restrictions, behavioural conditions, or conditional access for predictable machine patterns. That matters because perfect secret hygiene is unrealistic in large estates. The control objective becomes blast-radius reduction, meaning a compromised credential is useful only within tightly defined limits rather than across the full environment.

Practical implication: pair posture findings with runtime policy so exposed credentials cannot be used everywhere.

Threat narrative

Attacker objective: The attacker aims to turn one exposed machine credential into durable, cross-system access that can support lateral movement, persistence, and data theft.

1. Entry occurs when attackers harvest static NHI credentials from repositories, logs, configuration files, or public sources where machine secrets are frequently exposed.
2. Escalation follows when the compromised NHI is reused across multiple applications or cloud services, giving the attacker broad standing access without human challenge.
3. Impact comes through lateral movement, persistence, and data access across the identity graph, especially when owner mapping and runtime enforcement are missing.

Breaches seen in the wild

• Dropbox Sign breach — compromised Dropbox Sign service account exposed API keys and OAuth tokens.
• Sisense breach — unauthorized GitLab access led to exfiltration of access tokens, API keys and certificates.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

NHI security is no longer a secrets problem, it is an identity governance problem. Secrets rotation reduces one exposure mode, but it does not solve discovery, ownership, lifecycle, or runtime enforcement. The article is correct to frame the issue as a full-NHI governance gap rather than a tooling gap. Organisations that keep treating these identities as isolated credentials will continue to miss the relationships that create blast radius.

Static credential trust debt is the right concept for this category. Every long-lived token, password, or key creates a future obligation to detect, trace, rotate, and revoke it across multiple systems. That debt compounds when the same NHI is reused by more than one application or copied into multiple locations. The practitioner conclusion is simple: the longer the credential lives, the more governance debt the programme accrues.

Fragmented ownership is the control failure that keeps NHI risk invisible. A machine identity with no clear business owner cannot be safely remediated, recertified, or deprovisioned. That is not just an operational inconvenience, it is a governance defect that breaks accountability across IAM, IGA, and PAM. The organisation needs ownership as a first-class control, not a metadata afterthought.

Runtime enforcement is the point where NHI security becomes materially different from reporting. Discovery tells you what exists, but policy at authentication time tells you what an identity can actually do. That distinction matters because many NHI risks are only reduced, not eliminated, by hygiene tasks such as rotation. The practitioner takeaway is that enforcement must be designed to limit blast radius even when credential exposure cannot be fully prevented.

OWASP Non-Human Identity Top 10 should be read as a governance map, not a checklist. The recurring themes of overprivilege, secret exposure, and lifecycle weakness are connected failure modes, not separate hygiene tasks. The field should stop framing NHI risk as a set of discrete fixes and start treating it as a system problem spanning identity creation, usage, review, and retirement. That is the governance model the category now requires.

From our research:

• Only 5.7% of organizations report being able to accurately inventory all NHIs in their environment, according to The 2025 State of NHIs and Secrets in Cybersecurity.
• 91% of former employee tokens remain active after offboarding, according to The 2025 State of NHIs and Secrets in Cybersecurity.
• For a deeper operational lens, compare this with NHI Lifecycle Management Guide, which shows where provisioning, rotation, and offboarding controls break down in practice.

What this signals

Static credential trust debt: As environments add AI workflows, SaaS integrations, and cloud automations, the number of machine identities will keep rising faster than most teams can inventory them. The programme risk is not simply more secrets, but more identities that persist outside normal lifecycle controls and create hidden remediation obligations.

The practical signal is that NHI programmes must move from reactive secret cleanup to policy-led governance. Teams that still rely on periodic reviews alone will keep missing dormant accounts, duplicated credentials, and ownerless access paths, especially in hybrid estates where the Secret Sprawl Challenge is already visible.

For practitioners

• Build a unified NHI inventory Aggregate service accounts, API keys, OAuth tokens, and certificates across cloud, SaaS, DevOps, and directory systems so ownership and usage can be correlated in one place.
• Map every NHI to a responsible owner Use metadata, naming conventions, tagging, and behavioural signals to assign a business or technical owner before remediation workflows begin.
• Prioritise posture by observed behaviour Compare what each NHI is permitted to do against what it actually does, then focus remediation on unused permissions, dormant identities, and repeated secret exposure.
• Enforce runtime restrictions on high-risk identities Apply conditional access, location fencing, and policy-driven controls at authentication time so compromised credentials cannot be used broadly.
• Automate lifecycle actions for dormant NHIs Disable inactive identities after defined thresholds, then route findings into event-driven ticketing so revocation and owner notification happen without manual delay.

Key takeaways

• NHI risk is a governance problem because discovery, ownership, lifecycle, and runtime control are all required to manage machine identities safely.
• The scale problem is already severe, with only 5.7% of organisations able to inventory all NHIs and 80% facing high or critical posture issues.
• The control model that matters is unified inventory plus blast-radius enforcement, not secret rotation in isolation.

Key terms

• Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
• Identity Graph: An identity graph is a relationship map that connects identities, assets, data, and permissions so teams can see how access actually flows. In NHI programmes, it helps explain which agent is related to which owner, which system, and which policy boundary.
• Runtime Enforcement: Runtime enforcement is the practice of blocking malicious behaviour while software is running, rather than only detecting it after the fact. It monitors process activity, network actions, and privilege changes so a live attack can be interrupted at the point of execution.
• Static Credential Trust Debt: Static credential trust debt is the accumulated risk created when long-lived secrets remain valid after the work they support has moved on. For AI agents and workloads, it means the credential can outlive the task, be replayed elsewhere and increase breach impact far beyond the original use case.

What's in the full article

Silverfort's full article covers the operational detail this post intentionally leaves for the source:

• Detailed workflow guidance for building a unified NHI inventory across cloud, SaaS, and DevOps systems
• Examples of posture findings based on behaviour, ownership, and exposure signals
• Practical remediation patterns for rotating secrets, restricting access, and automating lifecycle actions
• Runtime enforcement approaches for limiting what compromised NHI credentials can do

👉 Silverfort's full post covers the inventory, posture, and enforcement model in more operational detail.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or programme maturity, it is worth exploring.