TL;DR: GitGuardian’s analysis of OWASP’s 2025 Top 10 shifts emphasis toward broken access control, security misconfiguration, and broader software supply chain failures, with GitGuardian highlighting how those changes map directly to exposed NHIs, secrets sprawl, and build-chain risk. NHI governance now sits closer to the centre of application security because access assumptions, not just code defects, are driving the blast radius.
At a glance
What this is: This analysis of OWASP’s 2025 Top 10 says the ranking now leans more heavily on root causes, broader supply chain exposure, and the identity and secrets problems that sit behind modern application risk.
Why it matters: It matters because IAM, NHI, and secrets programmes are increasingly where application security weaknesses become exploitable access paths rather than just configuration issues.
👉 Read GitGuardian’s analysis of the OWASP Top 10 2025 shifts in NHI and supply chain risk
Context
The OWASP Top 10 is a map of the most important web application security failure modes, and the 2025 update shifts that map toward access, configuration, supply chain, and runtime error handling. For NHI teams, the key point is that the ranking now reflects problems that are often expressed through service accounts, tokens, secrets, and cloud permissions rather than through code alone.
That matters because application security and identity security are converging at the point where credentials, permissions, and deployment pipelines determine what an attacker can reach. When OWASP promotes misconfiguration and supply chain failures, it is also describing the operational terrain where NHI governance and secrets hygiene either reduce or amplify blast radius.
Key questions
Q: What breaks when NHIs are given more access than their job needs?
A: The control that breaks is containment. Overprivileged NHIs turn one credential into a route across multiple systems, so compromise can quickly become escalation, lateral movement, and persistence. The more services an identity can reach, the harder it becomes to limit the damage to the original workload.
Q: Why do misconfigurations matter so much in NHI governance?
A: Misconfigurations matter because they define the trust boundary for secrets, roles, and cloud access. A credential can be perfectly valid and still create unacceptable risk if its storage, permissions, or defaults are wrong. In practice, NHI governance fails when teams review the secret but ignore the configuration around it.
Q: What are the signs that supply chain access is becoming risky?
A: Warning signs include credentials present in source control, build systems that reuse long-lived tokens, and deployment paths that can reach production with little separation of duties. Those patterns show that the supply chain can be turned into an identity path, not just a software delivery path. The risk rises when one leaked secret can touch multiple environments.
Q: How should teams govern secrets in infrastructure as code pipelines?
A: Teams should keep secrets out of code and move them into a dedicated runtime secrets service, then enforce policy that prevents repository storage and console exposure. The goal is to make credential lifecycle controls independent from the IaC repository, so revocation, rotation, and access review can happen without editing infrastructure templates.
Technical breakdown
How broken access control now includes non-human identities
Broken access control remains the central pattern because modern software rarely fails only at the application layer. The article shows OWASP folding Server-Side Request Forgery into access control because the real problem is not just request routing, but whether a system can be induced to access resources it should not. In NHI environments, the same logic applies when service accounts, CI tokens, or embedded secrets carry broader privilege than the task requires. Once those identities are abused, the attacker is operating inside an authorised path, not smashing through a perimeter.
Practical implication: treat service-account and token scope as an access-control control point, not only a secrets-management concern.
Why security misconfiguration is now a first-class identity risk
Security misconfiguration rises because cloud permissions, templates, and defaults now define much of the security boundary. The article links this to overly broad roles, cleartext secret storage, and insecure defaults, all of which are identity-adjacent failure modes even when they do not look like classic IAM issues. For NHIs, misconfiguration often means an identity exists in the right place but with the wrong scope, wrong storage, or wrong trust relationship. That makes configuration drift a governance issue, not just an engineering nuisance.
Practical implication: review identity-related configuration, not just secret contents, when you assess exposure.
How software supply chain failures widen the trust boundary
OWASP’s new supply chain category is broader than vulnerable components because it captures the build and distribution ecosystem as a whole. The article points to compromised dependencies, tampered build systems, and malicious packages, which means trust is no longer limited to source code provenance. For identity teams, the important detail is that leaked credentials, CI tokens, and deployment secrets can convert a supply chain weakness into direct infrastructure access. Supply chain defence therefore has an identity dimension even when the initial flaw is not identity-specific.
Practical implication: include CI, build, and deployment credentials in supply chain threat models and exposure reviews.
Threat narrative
Attacker objective: The attacker wants authorised-looking access that turns a source, build, or application weakness into broader infrastructure compromise.
- Entry occurs when an attacker abuses weak access enforcement, exposed secrets, or a compromised build path to reach resources they should not control.
- Credential access follows when the attacker obtains NHIs such as tokens, API keys, or service-account secrets that provide persistent or delegated access.
- Impact occurs when that access is used to move through infrastructure, modify code or deployments, or expand the blast radius of the original compromise.
Breaches seen in the wild
- PyPI secrets exposure 2023: Researchers found 3,938 unique secrets in published PyPI packages, 768 still valid; a new release or yank does not remove them.
- Millions of Misconfigured Git Servers Leaking Secrets: Nearly 5 million misconfigured Git servers expose sensitive secrets and credentials online.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
OWASP’s 2025 Top 10 is increasingly an identity governance document in disguise: the categories that matter most now describe how access is granted, mis-granted, or preserved across software delivery. That shift pulls NHI governance out of the supporting cast and into the centre of application security. Practitioners should read the ranking as a signal that access scope is becoming the primary control surface.
Broken access control is no longer just about authorisation logic in code: it now includes the NHIs that can reach code, infrastructure, and deployment systems with standing trust. Service accounts, CI tokens, and embedded secrets create a practical path from identity misuse to infrastructure abuse. The implication is that access governance must cover runtime identities with the same seriousness as human accounts.
Security misconfiguration is a governance failure before it is a technical one: the article’s emphasis on cloud permissions, templates, and defaults shows that many exposures arise from how access is assembled and maintained. That makes inventory, scope review, and permission hygiene essential parts of identity security. Teams that treat configuration as outside IAM will miss where the real exposure lives.
Software supply chain failures now depend on identity leakage as much as package integrity: compromised dependencies matter, but leaked credentials in source control, CI, and deployment paths are what often turn compromise into operational reach. Identity blast radius: the practical risk is not just that code is tainted, but that the credentials around the code can be used to extend access across environments. Practitioners should govern the chain of trust, not just the artifact.
From our research library:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
- 73% of vaults are misconfigured, leading to unauthorised access and exposure of sensitive data, according to the Ultimate Guide to NHIs.
- Read next: Guide to the Secret Sprawl Challenge
What this signals
The 2025 OWASP ranking reinforces a broader point that identity teams can no longer treat application risk, pipeline risk, and secrets risk as separate workstreams. When service accounts and deployment credentials become the path through which misconfiguration and supply chain failures turn into incidents, governance has to move upstream into build and runtime control points.
Identity blast radius: the real question is not whether a secret exists, but how far it can travel once exposed. That framing changes prioritisation for NHI programmes because access scope, pipeline propagation, and offboarding are now part of the same control problem.
For practitioners
- Inventory every non-human identity that can reach code or infrastructure Map service accounts, CI tokens, API keys, and deployment secrets to the systems they can touch, then remove identities that no longer have a clear owner or use case.
- Reassess access scope for build and deployment credentials Compare actual permissions against the narrowest task each identity must perform, and flag any credential that can read, modify, or deploy beyond its intended pipeline stage.
- Treat misconfiguration as an identity exposure signal Review cloud roles, secret storage settings, and default permissions together, because each can turn a credential leak into a larger access-control failure.
- Extend supply chain reviews to credential handling Check where secrets, tokens, and keys are stored or propagated through source control and CI so that package risk and identity risk are assessed in the same review.
Key takeaways
- The 2025 OWASP update shifts attention from isolated code flaws toward access, configuration, and supply chain conditions that routinely involve NHIs.
- Secrets, service accounts, and CI credentials become the practical route from misconfiguration to compromise when they are over-scoped or poorly governed.
- Identity teams should align inventory, scope review, and secret handling with pipeline and build controls so that application risk is managed at the point where access is actually granted.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK define the specific risk controls and attack patterns relevant to this term.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 — Secret Leakage | The article links exposed secrets in code, CI, and deployment paths to broader access risk. |
| NHI-03 — Vulnerable Third-Party NHI | The article’s supply chain emphasis includes third-party and build-path identities that can widen exposure. | |
| NHI-05 — Overprivileged NHI | Overbroad service-account and pipeline permissions are a central theme in the access-control analysis. | |
| Recommendation — Scan code and CI for leaked secrets and revoke any credential that can be reused outside its intended scope. Review third-party and build-chain identities for inherited access paths before they can be abused in production. Reduce NHI permissions to the minimum task scope and remove any standing privilege that exceeds it. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | The article describes credentials as the route from initial exposure to broader infrastructure reach. |
| Recommendation — Map leaked credentials to credential-access and lateral-movement hunt logic across code, CI, and cloud environments. | ||
Key terms
- Broken Access Control: Broken access control occurs when a system fails to restrict what an authenticated user, service, or workload can do. The issue often appears as missing checks, inconsistent enforcement, or excessive permissions. It is a structural weakness because attacks exploit the gap between verified identity and permitted action.
- Security Misconfiguration: Security misconfiguration is a control failure caused by unsafe defaults, incorrect settings, or overly broad permissions in systems and pipelines. In NHI environments, it often shows up as exposed secrets, persistent roles, or permissive cloud templates. The risk is that routine automation becomes a durable access path.
- Software Supply Chain Failure: A software supply chain failure is any breakdown in the build, dependency, signing, or distribution chain that allows tampering, compromise, or unauthorized access. For NHI security, the concern is not only corrupted code but also the credentials and machine identities that move that code through the pipeline.
- Honeytoken: A honeytoken is a deliberately planted secret or credential designed to be detected when used. It helps security teams spot misuse early, especially in environments where machine identities and automation can move faster than manual investigation or containment.
What's in the full article
GitGuardian's full article covers the operational detail this post intentionally leaves for the source:
- How GitGuardian maps the OWASP 2025 categories to concrete NHI governance use cases
- Examples of how exposed secrets in CI and source control become access-control problems
- Details on GitGuardian's honeytokens as tripwires for supply chain compromise
- The vendor's reasoning behind prioritisation of broken access control, misconfiguration, and supply chain risk
Deepen your knowledge
NHI governance, secrets management, and workload identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on May 31, 2026.
Updated on October 7, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org