TL;DR: Many organisations still cannot see how many non-human identities and associated secrets they have, leaving service accounts, API keys, OAuth tokens, vaults, CI/CD pipelines and collaboration tools as hidden exposure points, according to Entro Security. Continuous discovery and behavioural context are now required because point-in-time scanning cannot keep pace with secret sprawl.
At a glance
What this is: This analysis argues that discovery and inventory for non-human identities still miss hidden secrets across cloud, code, pipelines, and collaboration tools.
Why it matters: For IAM and NHI teams, the issue is not just finding credentials but maintaining enough lifecycle and usage context to reduce exposure before secrets become persistent attack paths.
By the numbers:
- 79% of organisations have experienced secrets leaks, with 77% of these incidents resulting in tangible damage, according to the Ultimate Guide to NHIs.
Context
Non-human identity discovery is the process of locating service accounts, API keys, OAuth tokens, certificates, and the secrets attached to them across an environment. The governance gap is that most programmes still treat discovery as a one-time scan, even though credentials now move through code, cloud, CI/CD, collaboration tools, and short-lived automation paths.
Entro Security’s analysis argues that this creates blind spots in the NHI lifecycle: you can’t govern what you cannot inventory, and you cannot inventory what keeps changing location and context. The article frames continuous visibility as the practical baseline for service accounts and machine credentials, not an advanced enhancement.
The article also extends the problem into AI and automation workflows, where hidden secrets are not just stored but reused, propagated, and delegated across multiple systems. That makes NHI governance a lifecycle issue rather than a search problem.
Key questions
Q: What breaks when non-human identity discovery is only done periodically?
A: Periodic discovery leaves service accounts, API keys, and tokens invisible between scans, which means teams lose track of where secrets move and who still depends on them. The result is stale inventory, delayed revocation, and an exposure window that persists long after a secret has spread into code, pipelines, or collaboration tools.
Q: What problem does ownership attribution solve for service accounts and API keys?
A: It closes the gap between exposure detection and accountable remediation. Many organisations can find the secret, but not the human who introduced it, maintains it, or can safely replace it. Ownership attribution gives security teams a practical way to assign action without relying on informal knowledge that disappears during staff changes.
Q: How do security teams know if NHI controls are actually working?
A: Look for complete inventory coverage, clear ownership, enforced rotation, and evidence that unused credentials are removed on time. If secrets remain active after changes to applications, vendors, or pipelines, the control is not working. Monitoring should also show whether machine access stays within the expected workload scope.
Q: How should teams handle secrets found in CI/CD logs or collaboration tools?
A: They should treat those locations as first-class secret sources, not side channels. If detection only covers repositories, secrets pasted into logs, chat, ticketing, or document systems will stay invisible even though they can still grant access. Coverage has to follow where developers actually work.
Technical breakdown
Why point-in-time scanning misses hidden secrets
Static discovery tools are built to enumerate known storage locations, but non-human identities rarely stay in one place. Service accounts appear in cloud IAM, API keys live in repositories, OAuth tokens sit in workflow tools, and certificates may be embedded in deployment paths. When those artefacts move between vaults, pipelines, chat tools, and infrastructure-as-code, a single scan only captures a fragment of the estate. The technical failure is not visibility alone but continuity: the identity and the secret are decoupled from the moment of creation through use, rotation, and decommissioning.
Practical implication: treat discovery as a continuous control that follows secrets across storage, execution, and propagation points.
How secret propagation creates governance blind spots
Secrets propagation happens when one system retrieves credentials from another and passes them into a third or fourth environment, often temporarily and often without durable records. A deployment pipeline may pull from a vault, inject credentials into cloud runtime, and leave artefacts in logs, variables, or shared workspaces. That propagation chain is what makes NHI inventory hard: the credential’s storage location is not the same as its operational footprint. Without context on where a secret has been used, discovery produces a list of objects rather than a map of exposure.
Practical implication: inventory both the source secret and the systems that consumed or relayed it.
Why behavioural context matters after inventory
Finding a secret is only the first step. Security teams need to know whether a service account is acting inside expected hours, whether an API key is used from normal networks, and whether an OAuth token is granting access consistent with its intended delegation chain. Behavioural context turns an inventory into governance evidence because it distinguishes dormant credentials from active attack paths. In NHI terms, the question is not simply whether an identity exists, but whether its actual usage matches the privilege and environment in which it was created.
Practical implication: pair discovery with usage analytics so inventory can drive risk-based remediation.
Breaches seen in the wild
- Hugging Face Spaces breach 2024: Unauthorised access to Hugging Face Spaces may have exposed secrets users stored for AI apps; tokens were revoked and org tokens removed.
- Dropbox Sign breach 2024: A compromised back-end service account gave attackers Dropbox Sign customer data, including API keys, OAuth tokens and MFA information.
Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Continuous discovery is now the minimum viable control for NHI governance. The article’s central point is that secrets no longer live in a single vault or repository, so periodic scans miss the real attack surface. That matters because discovery failures are lifecycle failures: if a team cannot continuously locate service accounts and machine credentials, it cannot govern ownership, exposure, or revocation with any confidence. The practitioner conclusion is clear: inventory has to move from project activity to standing control.
Hidden secrets create identity debt long before an incident occurs. Once credentials spread across CI/CD, collaboration tools, cloud services, and configuration artefacts, the organisation accumulates inherited risk it cannot easily see or retire. That is not just poor hygiene, it is a structural governance problem because stale artefacts continue to authenticate long after teams assume they have been contained. The practitioner conclusion is to treat undiscovered secrets as outstanding governance liabilities, not dormant technical leftovers.
Service account visibility and secret visibility are the same control problem. The article shows that the account, the credential, and the runtime location are often separated, which means teams can measure neither scope nor ownership cleanly. That separation drives overconfidence in existing inventories and creates false comfort around coverage. The practitioner conclusion is to unify account inventory, secret inventory, and usage context into one operational view.
Blast-radius control starts at discovery, not at response. Once a credential is hidden in a pipeline, chat thread, or cloud-native runtime, response actions arrive too late to shape the original exposure window. The governance question is therefore not whether teams can clean up after the fact, but whether they can see enough of the estate to prevent uncontrolled reuse. The practitioner conclusion is to make discovery the first gate in secrets risk reduction.
Ephemeral infrastructure does not reduce NHI exposure by itself. The article makes clear that short-lived pipelines, autoscaling, and serverless delivery actually increase the rate at which secrets appear, move, and disappear from view. That means the old assumption that faster infrastructure creates smaller governance burden no longer holds. The practitioner conclusion is to redesign inventory for motion, not for static assets.
From our research library:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to the Ultimate Guide to NHIs.
- Read next: Ultimate Guide to NHIs — Key Challenges and Risks
What this signals
Discovery is becoming the boundary between governed and ungoverned NHI estates. Teams that still rely on periodic scans will continue to miss credentials as they move across cloud services, repositories, and collaboration tools. The programme implication is that inventory has to be treated as an always-on control, not a compliance checkpoint.
Service accounts, API keys, and OAuth tokens now need one operational view. The article’s strongest signal is that secret sprawl is not a storage problem alone, it is a propagation problem. That means the reader’s next step is to unify discovery, ownership, and usage context before exposure paths become too distributed to manage.
Hidden credential propagation creates identity debt that compounds over time. Once a secret leaves its original system, the organisation inherits a trail of reuse, duplication, and uncertain ownership. NHI programmes that cannot map that trail will struggle to reduce blast radius or enforce timely revocation.
For practitioners
- Build continuous NHI discovery coverage Scan cloud vaults, repositories, CI/CD systems, collaboration platforms, and runtime environments on an ongoing basis so hidden secrets are not left to periodic audits.
- Correlate secrets with their usage paths Track where each credential is stored, where it is injected, and which services or workflows consume it so the inventory reflects actual exposure, not only storage locations.
- Prioritise high-blast-radius identities first Focus remediation on production service accounts, inherited cloud roles, and tokens with broad delegation because those identities create the largest downstream impact if discovered or abused.
- Treat collaboration tools as secret sources Include Slack, Teams, and similar workspaces in discovery and response workflows because temporary sharing often becomes durable credential exposure.
- Pair discovery with behavioural baselines Compare normal access times, source networks, and resource usage against current activity so you can distinguish legitimate machine behaviour from risky reuse or abuse.
Key takeaways
- Hidden secrets across cloud, code, pipelines, and collaboration tools make NHI inventory incomplete unless discovery follows credentials continuously.
- The article frames discovery gaps as a governance problem because teams cannot manage credentials they cannot locate, trace, or contextualise.
- The practical response is to connect discovery, ownership, and usage so exposed secrets can be prioritised by blast radius rather than by where they were first found.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 — Secret Leakage | The article centres on secrets leaking into repositories, pipelines, and collaboration tools. |
| NHI-03 — Vulnerable Third-Party NHI | The article notes delegation chains and external integrations that widen secret exposure. | |
| NHI-05 — Overprivileged NHI | Service accounts and cloud identities in the article often carry broad permissions and blast radius. | |
| Recommendation — Map exposed credentials to NHI-02 and remove secrets from all uncontrolled storage locations. Review third-party access paths for secrets that cross organisational boundaries and inventory them explicitly. Reduce standing privilege on service accounts whose secrets appear in multiple environments. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Authenticator lifecycle control is directly relevant to leaked keys, tokens, and certificates. |
| Recommendation — Apply IA-5 to govern issuance, rotation, and revocation of non-human authenticators. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article focuses on knowing what identities exist and what access they actually carry. |
| Recommendation — Use PR.AA-05 to maintain accurate entitlement inventories for service accounts and tokens. | ||
| MITRE ATT&CK | TA0006; TA0008 — Credential Access; Lateral Movement | Hidden secrets enable credential access and downstream movement across cloud and pipeline surfaces. |
| Recommendation — Map leaked NHI secrets to TA0006 and TA0008 to prioritise detection around exposed credentials. | ||
Key terms
- Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
- Secrets Sprawl: The uncontrolled proliferation of sensitive credentials, API keys, tokens, passwords, certificates, across codebases, cloud environments, CI/CD pipelines, and configuration files. In 2024, over 50 million leaked secrets were found on the dark web.
- Secrets Discovery: Secrets discovery is the process of finding credentials wherever they exist across code, infrastructure, pipelines, and collaboration tools. It turns unknown access paths into governable objects by identifying location, owner, and usage so teams can stop treating exposed secrets as hidden exceptions.
- Behavior Baseline: A record of normal activity for a non-human identity, including typical consumers, resources, and actions over time. Baselines help security teams detect when an identity is being used in an unusual way and provide the context needed to enforce least privilege safely in dynamic environments.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on May 13, 2026.
Updated on October 6, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org