OWASP NHI Top 10 gives teams a framework for identity risk

At a glance

What this is: SGNL argues that the OWASP NHI Top 10 gives teams a practical framework for judging non-human identity risk, especially around overprivilege, secret leakage, long-lived secrets, and secret reuse.

Why it matters: It matters because IAM, PAM, and NHI programmes need a shared way to prioritise controls when machine identities outnumber human ones and standing access is still common.

Context

The core governance problem is not that NHIs exist, but that many organisations still treat them as a side issue inside human-centric IAM models. That leaves policy decisions, privilege scope, and secret handling under-discussed until a leak, misuse event, or audit finding forces the issue.

SGNL’s analysis uses the OWASP NHI Top 10 to argue for a more structured way to talk about NHI exposure. The article frames the list as a shared vocabulary for risk management, not a complete answer, which is the right starting point for any programme that has to govern service accounts, API keys, tokens, certificates, and workload identities.

Key questions

Q: Where does NHI governance fail when access is still standing at runtime?

A: It fails when teams assume a credential can be safely reviewed after it has already been used. Standing access lets a leaked or unnecessary NHI remain active long enough to be abused, so the control point has to move toward issuance, scope, and revocation at the moment of use.

Q: Why do long-lived secrets and overprivilege increase NHI breach impact?

A: They compound each other. A long-lived secret keeps access alive, overprivilege widens what that access can do, and secret reuse turns one compromise into several. The result is a larger blast radius, faster lateral movement, and more work for containment and forensics.

Q: What are the signs that access reviews are failing to control NHI privilege?

A: Look for rubber-stamped approvals, unexplained broad entitlements, identities with no clear owner, and permissions that remain active long after the work they support should have ended. Those signals show that the review process is operating on incomplete context and is not actually reducing exposure.

Q: How should teams handle human use of NHI in administrative workflows?

A: Treat it as an accountability problem, not just a permissions problem. The human requester, the NHI executor, and the business purpose all need to remain visible, otherwise logging becomes ambiguous and revocation decisions become harder to defend.

Technical breakdown

Why standing access changes NHI risk maths

Standing access is the operational pattern that makes NHI governance hard. Once an API key, token, certificate, or service account can act continuously, the decision about whether it should still be active is no longer tied to the moment of use. That breaks the usual review rhythm found in human IAM, where access can be certified after provisioning. The article’s central point is that policy has to be evaluated at the time of need, not only at issuance or during periodic review. In NHI terms, privilege is a live condition, not a static assignment.

Practical implication: move review and enforcement closer to issuance and runtime context rather than relying on periodic attestation alone.

Overprivilege, long-lived secrets, and secret reuse

The OWASP list surfaces three related failure modes that often travel together. Overprivilege gives an NHI more access than its workload needs. Long-lived secrets extend that access far beyond the original business need. Secret reuse then multiplies the blast radius because one leaked credential can unlock multiple environments or services. These are not separate hygiene issues so much as a chain of compounding governance debt. The article is strongest when it treats them as one risk pattern, because each makes the others harder to contain.

Practical implication: inventory which NHIs share credentials or reuse the same secret across environments before trying to optimise rotation cadence.

Why human use of NHI is a governance signal

NHI10, human use of NHI, is the most debatable item in the list, but it still exposes an important boundary problem. When humans rely on machine identities to perform administrative tasks, attribution, logging, and approval flows can become blurry. That does not automatically make the practice wrong, but it does mean the governance model must distinguish between human intent and machine execution. In practical terms, this is where identity lineage and accountability matter as much as the credential itself.

Practical implication: separate who requested the action from which NHI executed it, so accountability survives delegated administration.

Threat narrative

Attacker objective: The attacker aims to turn one compromised NHI credential into broader system access and operational control.

1. Entry begins when a leaked or reused secret gives access to an NHI-controlled service or workload.
2. Escalation follows when that identity already has standing privilege or broader access than the workload actually needs.
3. Impact comes from the attacker using that access to move across systems, consume data, or alter cloud resources before the credential is revoked.

Breaches seen in the wild

• Scania insurance portal breach 2025: An attacker used an external user login, likely stolen by infostealer malware, to take insurance claim documents from a Scania portal.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

OWASP NHI Top 10 works because it turns a diffuse risk into a governable category. NHI programmes fail when every service account, token, certificate, and API key is treated as a one-off exception. A shared issue taxonomy creates the minimum language needed for policy, audit, and remediation conversations. The practical consequence is that governance teams can finally compare risk across workloads instead of arguing from anecdotes.

Standing access is the real design flaw behind many NHI problems. The list is useful because it points to conditions where access persists beyond the moment of need. That persistence makes overprivilege, secret reuse, and secret leakage materially harder to contain. Practitioners should read the Top 10 as evidence that privilege now behaves like inventory debt, not just authentication plumbing.

Privilege is no longer a human-only governance concept. The article correctly ties human and non-human identities together through privilege patterns, because both can accumulate access that outlives intent. That means IAM, PAM, and NHI governance have to converge on the same operational questions: who can act, for how long, under what context, and with what revocation path. The implication is that separate human and machine control planes create blind spots.

Human use of NHI exposes accountability gaps more than it creates a new class of threat. The article is right to question whether the issue is a risk category or a symptom of how organisations already operate. When humans use NHIs for admin work, logging and attribution can drift apart unless governance explicitly preserves the requestor, the executor, and the purpose. Practitioners should treat this as an accountability design problem, not a naming exercise.

OWASP-NHI gives the market a common control surface, not a finished programme. The most valuable effect of the Top 10 is that it standardises discussion around offboarding, secret leakage, overprivilege, and reuse. That makes it easier to align remediation effort with actual exposure rather than with whichever incident happened most recently. The next step for teams is to convert the taxonomy into measurable ownership and enforcement boundaries.

From our research library:

• NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
• Read next: Ultimate Guide to NHIs — Key Challenges and Risks

What this signals

Identity governance has to stop assuming that privilege is mainly a human problem. NHIs now sit in the same decision path as users, but they often operate faster and with less visibility. That means access review models built for people need to be rethought around issuance, runtime context, and revocation for machine identities.

Secret sprawl is becoming a lifecycle problem, not just a leakage problem. The real issue is that a secret often outlives the workload, the deployment, or the business need it was created for. Governance teams should treat secret handling as part of identity lifecycle management, not as a separate operational chore.

For practitioners

• Map all standing NHI access Identify service accounts, API keys, tokens, and certificates that remain valid beyond a single task or deployment and classify them by business criticality.
• Eliminate secret reuse across environments Find credentials shared between development, test, staging, and production, then separate them so a single exposure cannot unlock multiple systems.
• Reduce overprivilege at the workload level Review whether each NHI is authorised for the minimum set of actions its workload actually performs, including cloud resource and administrative permissions.
• Preserve human accountability in delegated NHI use Record the human requestor, the NHI executor, and the approved purpose whenever a person triggers machine identity use for administrative work.

Key takeaways

• The OWASP NHI Top 10 gives security teams a common way to discuss non-human identity exposure instead of treating each credential type as an isolated case.
• The risk pattern is cumulative: standing access, overprivilege, long-lived secrets, and secret reuse all widen the blast radius when something goes wrong.
• IAM and PAM teams should use the taxonomy to tighten ownership, reduce persistence, and make NHI revocation part of the control design, not an afterthought.

Key terms

• Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
• Standing Access: Standing access is persistent privilege that remains available without fresh approval or contextual checks. In NHI environments, standing access usually appears as long-lived tokens, reusable service accounts, or broad roles attached to automation. It is convenient operationally, but it expands risk when conditions change or secrets leak.
• Secret Reuse: Secret reuse is the practice of using the same password, token, or credential across multiple systems or functions. It multiplies the impact of any single dump because one compromised secret can authenticate to several environments, creating a much larger blast radius.
• Overprivilege: Overprivilege is access that exceeds what an identity needs to perform its task. In cloud environments, it often accumulates through role creep, inherited permissions, and temporary exceptions that never get removed, turning ordinary accounts and machine identities into high-value escalation paths.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.