NHI security shifts from inventory to authorization truth

At a glance

What this is: This is Veza’s overview of NHI security, with a central finding that machine access must be governed through discovery, effective permissions, and least privilege rather than human-centric IAM assumptions.

Why it matters: It matters because identity teams need visibility into service accounts, tokens, bots, and agents before privilege drift turns into outages, audit gaps, or fast-moving abuse.

By the numbers:

• Only 5.7% of organisations have full visibility into their service accounts.
• 91% of former employee tokens remain active after offboarding, leaving organisations vulnerable to potential security breaches.
• 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface.

👉 Read Veza's analysis of NHI discovery, effective permissions, and least privilege

Context

Non-human identity security is the discipline of discovering, understanding, and governing machine access across service accounts, workload identities, tokens, API keys, bots, and agentic AI. Veza’s article argues that the hard problem is not inventory alone, but authorization truth: knowing what each identity can actually do, where that access came from, and how quickly it can be reduced without breaking production. This is squarely an NHI governance issue, not a people-identity problem.

The gap is familiar to IAM and PAM teams. Human-centric controls assume sign-in events, interactive users, and stable ownership; machine identities are often created in pipelines, reused across applications, and left active long after the original purpose changes. That makes ownership, effective permissions, and lifecycle control the core decision points. The article’s starting position is typical for modern enterprise environments, where machine access is widespread but only partially understood.

Key questions

Q: How should security teams govern service accounts at enterprise scale?

A: Security teams should govern service accounts through automated discovery, ownership mapping, scoped permissions, and retirement controls. The priority is to remove manual dependency on managers and ticket queues, because machine identities move faster than human review processes. Governance works only when inventory, access policy, and offboarding are tied to runtime systems.

Q: Why do non-human identities create more risk than many human accounts?

A: NHIs often outnumber human users, have broader permissions, and operate with less day-to-day review. That combination increases the chance that a single exposed secret or delegated token can be reused across systems without detection. The risk is not just compromise, but silent persistence inside automated workflows and third-party integrations.

Q: What do teams get wrong about least privilege for NHIs?

A: They often apply least privilege at creation time and assume it stays valid. In practice, workload scope changes, integrations expand, and service accounts accumulate permissions over time. Least privilege for NHIs has to be revisited as a living control, not a one-time setup step.

Q: Who is accountable when a machine credential is abused?

A: Accountability should sit with the team that owns the workload, the identity lifecycle, and the connected business process, not with security alone. In regulated environments, that usually means engineering, platform, and IAM teams share responsibility for discovery, rotation, and offboarding while compliance verifies that the process is repeatable.

Technical breakdown

Why effective permissions matter more than raw identity counts

Raw counts of service accounts or tokens tell you very little about risk. Effective permissions resolve roles, policies, ACLs, and group memberships down to actual actions on actual resources, which is what matters when a machine identity is compromised or overused. In NHI environments, one identity can inherit broad rights across cloud, SaaS, and data layers, and the meaningful question becomes blast radius, not just existence. That is why graph-based authorization analysis has become central to NHI governance and ITDR workflows.

Practical implication: build entitlement views around effective permissions, not just identity lists.

How credential hygiene changes when machine identities outlive teams

Machine credentials often persist because they are embedded in code, CI/CD systems, containers, and service integrations. Unlike human passwords, these secrets may never trigger a login prompt, so rotation and revocation depend on lifecycle governance, usage telemetry, and ownership assignment. Long-lived or unused credentials are especially dangerous because they create silent access paths that remain valid even when the original application, team, or vendor relationship has changed. The governance failure is persistence without accountability.

Practical implication: inventory age, usage, and ownership for every token, key, and certificate.

What least privilege means for non-human identities

Least privilege for NHIs is not a static policy statement. It is an evidence-based design exercise that maps an identity’s minimum required actions, validates whether those actions can be narrowed, and simulates operational impact before change. This is why access profiles and owner-centric reviews matter: they create a practical way to right-size access without breaking application behavior. The technical challenge is separating necessary runtime function from accumulated privilege that no longer serves the workload.

Practical implication: use simulated access reductions before enforcing least-privilege changes.

Threat narrative

Attacker objective: The attacker aims to turn machine access into fast, low-friction reach across systems, data, and change functions while remaining inside legitimate authorization boundaries.

1. entry: a service account, token, or API key is exposed through code, SaaS workflows, or other machine access paths that were not tightly governed.
2. credential_harvested: the exposed credential is reused to authenticate as the non-human identity and inherit its existing permissions.
3. escalation: over-provisioned rights and weak ownership let the attacker expand reach across connected systems and sensitive data.
4. impact: the attacker uses authorization truth about the identity to scope abuse, move faster, and contain less visible activity.

Breaches seen in the wild

• Moltbook AI agent keys breach — Moltbook breach exposed 1.5M AI agent keys.
• Meta AI Instagram Account Takeover — 20,225 Instagram accounts hijacked via compromised Meta AI support chatbot with overprivileged access.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Authorization truth is now the centre of NHI governance. Counting machine identities is useful, but it does not answer the operational question that matters: what can this identity actually do right now, and how far can that action travel? Veza’s framing reflects a broader industry shift from inventory to effective permissions, because the risk lives in inherited access, not just identity existence. Practitioners should treat permission resolution as the primary control surface.

Service account governance fails when ownership is unclear. The article correctly points to discovery, classification, and owner assignment as the front end of control, because orphaned identities are where lifecycle governance breaks first. When no accountable owner exists, recertification becomes formalistic and revocation becomes delayed. That makes ownership evidence, not just identification, a prerequisite for defensible access reviews.

Least privilege for NHIs is a runtime design problem, not a policy slogan. Effective NHI governance depends on being able to simulate change before it is enforced, because application breakage is a real constraint. The right model is minimum viable access tied to actual usage and change windows, then reduced through evidence. This is where IVIP-style visibility and ISPM-style posture management converge in practice.

Credential persistence creates identity blast-radius debt. Long-lived keys, tokens, and client secrets accumulate risk because they extend the usable lifetime of a machine identity beyond the lifecycle of the workload that created it. The result is a latent exposure window that survives team changes, pipeline changes, and ownership drift. Practitioners should read this as a warning that rotation without lifecycle control is only partial remediation.

Agentic AI widens the NHI problem but does not replace it. The article places agentic AI in the same identity category as other machine actors, which is the right starting point, but the governance implication is sharper: if the actor can select tools, access data, and act at runtime, then NHI controls need an additional policy layer for action scope. That means identity governance must now track both machine entitlement and agent behaviour.

From our research:

• Only 5.7% of organisations have full visibility into their service accounts, according to Ultimate Guide to NHIs.
• Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
• That is why the 52 NHI Breaches Analysis remains a useful companion resource for understanding how lifecycle gaps become incidents.

What this signals

Authorization truth is becoming the organising concept for NHI programmes. Teams that still rely on identity counts, IAM joiner-mover-leaver logic, or static role reviews will keep missing the real control surface. The next phase of maturity is to connect discovery, ownership, and effective permissions into one operating model, then use it to drive reduction decisions across cloud, SaaS, and data.

Identity blast radius is now a board-relevant metric. When a machine identity can touch sensitive data, deploy infrastructure, or alter change functions, the risk is no longer just compromise but speed and reach. Programmes that quantify reachable systems, recent exposure, and standing privilege will have a much stronger basis for prioritising remediation and reporting progress.

NHI lifecycle discipline has to extend beyond vaults and into operational change. Rotation matters, but the harder problem is proving that credentials, ownership, and access paths are still aligned after teams, pipelines, and vendors change. That is where lifecycle management, review workflows, and runtime monitoring need to operate together, not as separate controls.

For practitioners

• Map effective permissions for every high-value NHI Resolve roles, groups, ACLs, and policies to actual actions on sensitive systems so you can see blast radius before an incident occurs.
• Assign one accountable owner per machine identity Do not let service accounts, tokens, or app registrations sit without an owner who can attest usage, approve change, and revoke access when the purpose ends.
• Inventory secret age and observed usage Track long-lived credentials, unused tokens, and duplicated secrets across code, CI/CD, SaaS, and vaults so stale access paths can be removed in sequence.
• Simulate least-privilege reductions before enforcement Build access profiles for critical workloads, test the impact of narrower permissions, and only then remove surplus access with evidence attached to the review.
• Use activity signals to prioritise containment When an NHI behaves abnormally, focus on the identities with new privileged scope, unusual reach, or recent exposure rather than chasing every credential equally.

Key takeaways

• Machine identity risk is driven by effective permissions, ownership gaps, and credential persistence, not by identity count alone.
• The scale problem is already visible in the research, with only 5.7% of organisations claiming full visibility into service accounts.
• Practitioners should centre NHI governance on authorization truth, accountable ownership, and simulated privilege reduction.

Key terms

• Effective Permissions: Effective permissions are the access an identity can actually use after role inheritance, scope, and policy are applied. In Azure AI environments, they often matter more than the assigned role name because inherited rights can widen access to data, logs, and secret stores.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
• Access Profile: A logical bundle of entitlements grouped for a specific purpose, role, or audience. It lets IAM teams manage access as a unit instead of as isolated permissions, which improves request handling, certification, and revocation. The profile is only useful when its scope matches how the business actually operates.
• Credential Persistence: Credential persistence is the ability of an attacker to keep access after the original secret is revoked or the initial malware is removed. In identity terms, it usually means a second credential, key, or token has been added to the account lifecycle and now survives the first response action.

What's in the full article

Veza's full article covers the operational detail this post intentionally leaves for the source:

• Connector coverage across Entra ID, Okta, AWS, GCP, Kubernetes, source control, databases, and SaaS systems.
• Access Graph and Access Search workflows for resolving effective permissions to concrete actions and resources.
• Access Profiles and Access Reviews used to reduce NHI access without breaking production.
• Activity Monitoring and Access Intelligence examples for drift, escalation, and fleet-wide posture tracking.

👉 Veza's full article covers discovery, permission mapping, credential hardening, and monitoring workflows in more operational detail.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.