OWASP NHI Top 10 shows why machine identity governance is mission-critical

At a glance

What this is: This is Unosecur’s analysis of the OWASP NHI Top 10 and its central finding that machine identities are a mission-critical governance gap across modern infrastructure.

Why it matters: It matters because IAM, PAM and NHI programmes need to treat service accounts, API keys, OAuth apps and workload identities as governed assets, not background plumbing.

By the numbers:

• Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to the Ultimate Guide to NHIs.

👉 Read Unosecur's analysis of the OWASP NHI Top 10 and machine identity governance

Context

Machine identity governance is the discipline of discovering, controlling and retiring non-human identities such as service accounts, API keys, OAuth apps and cloud roles. The article argues that modern infrastructure now depends on these identities more than on human users, yet most organisations still manage them inconsistently or not at all.

The governance gap is not just visibility. It is the absence of lifecycle ownership, rotation, offboarding and privilege containment across systems that authenticate continuously and often at machine speed. The article’s core claim is that OWASP’s NHI Top 10 turns that scattered problem into a structured control agenda.

The article is typical of the current state of NHI maturity: many organisations already use these identities at scale, but their control model still lags their operational importance.

Key questions

Q: What breaks when non-human identities are not offboarded properly?

A: Orphaned NHIs remain valid long after the workload or integration they served is gone, which gives attackers a durable access path. The failure is not just administrative drift. It is living authentication that no longer has a legitimate owner, so compromise can happen through forgotten keys, tokens, or service accounts.

Q: Why do API keys and tokens on endpoints increase breach risk so much?

A: Because API keys and tokens act like non-human identities with immediate replay value. Once exposed in collaboration tools, browsers, or AI workflows, they can be used outside the original endpoint without resistance from device controls. Identity teams need visibility, rotation, and revocation, not just endpoint detection.

Q: How do security teams know if NHI governance is working?

A: Good NHI governance shows up in fewer shared credentials, shorter secret lifetimes, clear ownership for every machine identity, and offboarding that actually removes unused accounts. If teams still find tokens in chat, code, or ticketing systems, or cannot prove who owns a service account, the programme is not under control.

Q: What is the difference between machine identity inventory and lifecycle control?

A: Inventory tells you what machine identities exist. Lifecycle control decides whether they should still exist, whether they are still valid, and whether their permissions still match the workload they serve. Organisations need both, but only lifecycle control prevents stale credentials from becoming standing access.

Technical breakdown

Why machine identities become the hidden control plane

Service accounts, API keys, OAuth apps, bots and workload identities do not just support the business. They execute the business. In cloud and SaaS environments, these identities authenticate constantly, often with broader privileges than humans receive and with far less scrutiny. That changes the attack surface: compromise is no longer about logging in as a person, but about abusing a credential that was intended for automation, integration or orchestration. When those credentials are unmanaged, the identity layer becomes the real control plane of the environment.

Practical implication: inventory machine identities by function, ownership and privilege before you can govern them.

How offboarding and secret leakage create durable attack paths

The article’s risk model is built around stale identities and exposed secrets. Improper offboarding leaves abandoned accounts and tokens active after projects end, while secret leakage turns source code, logs and pipelines into credential distribution channels. Long-lived secrets are especially dangerous because they remain usable long after the context that created them has changed. Once leaked or forgotten, these credentials can impersonate legitimate automation with no user interaction and little immediate detection.

Practical implication: treat offboarding and secret revocation as linked lifecycle controls, not separate hygiene tasks.

Why overprivilege and weak cloud configuration enlarge blast radius

Machine identities are often granted broad access so workflows keep moving, but that convenience creates the conditions for large-scale compromise. Overprivileged roles, insecure OAuth trust rules, shared identities across environments and manual human use of machine credentials all widen the blast radius when an identity is abused. The problem is architectural: identities that were meant to be narrow, isolated and ephemeral are frequently reused across systems and trust boundaries, so a single failure can spread quickly across cloud and CI/CD estates.

Practical implication: map each NHI to a specific trust boundary and remove cross-environment or cross-workload reuse.

Threat narrative

Attacker objective: The attacker wants to turn machine trust into durable, low-noise access to data, workflows or cloud resources.

1. Entry occurs when attackers obtain a forgotten service account, leaked API key or overprivileged OAuth app that still has valid access.
2. Credential abuse follows as the attacker uses the machine identity to impersonate automation and reach cloud, SaaS or CI/CD resources.
3. Escalation happens when the compromised identity has broader permissions than necessary or is reused across multiple systems.
4. Impact is data theft, cloud access, or persistence through a credential that was never properly retired.

Breaches seen in the wild

• Dropbox Sign breach 2024: A compromised back-end service account gave attackers Dropbox Sign customer data, including API keys, OAuth tokens and MFA information.
• OneLogin API flaw (CVE-2025-59363): A OneLogin API flaw exposed OIDC client secrets to anyone with an API key, including vendors (CVE-2025-59363); fixed with no customer impact.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Machine identity governance has become a control-plane problem, not a tooling problem. The article’s real message is that service accounts, API keys and OAuth apps now sit inside the operational path of almost every enterprise workflow. That means the security model has to assume machine identities will authenticate constantly, across many systems, with human oversight arriving too late to be decisive. Practitioners need to treat NHI control as infrastructure governance, not a niche hygiene task.

Improper offboarding is the first structural failure in most NHI programmes. The article shows that forgotten test accounts, deprecated services and stale tokens remain valid long after business ownership has moved on. That is not an isolated exception; it is the predictable result of lifecycle ownership being unclear for non-human identities. The implication is that governance must start from identity retirement, not from post-compromise discovery.

Long-lived secrets create trust debt that compounds silently. Every API key or token that stays valid after its original purpose has ended extends the attack window and weakens attribution. In practice, that means remediation speed is not enough if the credential design still allows durable replay. Practitioners should read this as a warning that secret lifetime is itself a governance variable.

Identity reuse across workloads creates identity blast radius. When the same credential or service account is reused across systems, compromise of one path becomes compromise of many. That pattern also obscures ownership and makes revocation risky, because one change can break multiple workflows. The article correctly points to this as a structural issue in modern cloud estates, where convenience has outrun identity segmentation.

The OWASP NHI Top 10 confirms that machine identity risk is now a lifecycle discipline. The article connects visibility, automation and governance in a way that human IAM teams should recognise immediately. What changes here is not the existence of credentials but the pace and scale at which they move through the environment. The practitioner takeaway is that NHI governance has to be continuous, not periodic.

From our research library:

• NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
• Read next: Guide to NHI Rotation Challenges

What this signals

Identity blast radius: the article’s most useful concept is the idea that one machine credential can represent many connected trust relationships at once. When a service account or token is reused across workflows, the risk is not just compromise but propagation across systems that were never meant to share the same identity boundary.

OWASP NHI Top 10 thinking is most valuable when it forces teams to move from periodic review to continuous lifecycle control. Access reviews for humans do not solve machine identity sprawl, because the control point for NHIs is issuance, reuse and retirement rather than annual certification.

For practitioners

• Map every machine identity to an owner and retirement date Build an authoritative inventory for service accounts, API keys, OAuth apps and workload identities, then assign a business owner and planned decommission date to each one.
• Automate offboarding and revocation workflows Tie project closure, vendor termination and application retirement to secret revocation, account disablement and access removal so abandoned NHIs do not remain active.
• Reduce privilege before compromise happens Review machine permissions for scope creep, remove broad roles that were granted for convenience, and separate identities across distinct workloads and environments.
• Block human use of machine credentials Prohibit developers from manually using service tokens for debugging or ad hoc tasks, because that practice bypasses audit trails and obscures accountability.
• Instrument NHI detection for abnormal reuse and cross-environment access Monitor for dormant credential activation, unexpected privilege use and shared identities moving between test and production boundaries.

Key takeaways

• Machine identity exposure is a lifecycle problem because forgotten accounts, leaked secrets and reused tokens stay valid long after the original purpose has ended.
• The article frames NHI risk as broad and structural, with machine identities outnumbering human identities by 25x to 50x in modern enterprises.
• The practical response is to move governance to issuance, ownership, rotation and offboarding so machine credentials do not become durable attack paths.

Key terms

• Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
• Machine identity lifecycle: Machine identity lifecycle is the full governance process for a non-human identity from creation to retirement. It includes provisioning, access scoping, rotation, renewal, offboarding, and auditability, and it fails when any one of those steps is handled manually or inconsistently.
• Secrets Leakage: Secrets leakage is the exposure of credentials such as API keys, tokens, or certificates in places where they can be discovered and reused. The risk is not just disclosure, but unauthorized authentication that turns a coding or pipeline mistake into active access.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.

What's in the full article

Unosecur's full blog covers the operational detail this post intentionally leaves for the source:

• Incident-by-incident walkthroughs linking each OWASP NHI risk to a concrete breach example
• The vendor’s own lifecycle governance workflow for discovery, ownership assignment and revocation
• Benchmarking and scoring logic for measuring NHI resilience over time
• Implementation detail on how it correlates identities across AWS, Azure, GCP and SaaS

👉 The full Unosecur blog covers the breach examples, lifecycle controls and automation approach in more operational detail.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.