OWASP Top 10 for NHI exposes governance gaps in machine identity

At a glance

What this is: This is Saviynt’s analysis of the OWASP Top 10 for NHI, with the central finding that decentralized machine identities outpace human-centric governance models.

Why it matters: It matters because IAM, PAM, and IGA teams need controls that can govern service accounts, secrets, and AI-linked workloads at machine speed, not just human cadence.

By the numbers:

• 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface.
• Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
• NHIs outnumber human identities by 25x to 50x in modern enterprises.
• When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes, and as quickly as 9 minutes in some cases.

👉 Read Saviynt's analysis of the OWASP Top 10 for NHI

Context

Non-human identity governance fails when organisations treat service accounts, API keys, certificates, and workload credentials as infrastructure detail rather than identity. In cloud, CI/CD, and AI-enabled systems, the access path is often decentralized, short-lived, and hard to inventory, which makes periodic human IAM review cycles too slow to be effective.

The article uses the OWASP Top 10 for NHI as a familiar risk structure, but the practical issue is broader than a checklist. Teams need to recognise that NHI sprawl creates governance debt across discovery, privilege assignment, secret handling, and offboarding, especially where machine identities are embedded in third-party services and automated workflows.

Saviynt positions the problem as part of a wider identity security programme, which is the right frame. The real issue is not whether NHI controls exist in isolation, but whether they can keep pace with how machines are provisioned, delegated, and retired across the environment.

Key questions

Q: What breaks when organisations do not govern NHI offboarding properly?

A: Unrevoked machine credentials continue to authenticate after the workload, vendor relationship, or business purpose has changed. That creates orphaned access, hidden trust paths, and a larger blast radius if the credential is later exposed. Offboarding must revoke the identity everywhere it can authenticate, not just mark it inactive in one system.

Q: Why do NHIs complicate traditional IAM governance?

A: NHIs are created in many places, often outside central identity workflows, and they frequently outnumber human identities by a wide margin. That means reviews designed around slower human joiner-mover-leaver cycles miss the speed and scale of machine access. The result is persistent privilege drift and weak visibility.

Q: How should security teams reduce the impact of a compromised service account?

A: Reduce the impact by narrowing what the account can reach, shortening how long it can be used, and removing any reuse across environments. Pair least privilege with session monitoring and approval for sensitive actions. If the account can traverse multiple domains, assume compromise will spread unless reachability is segmented.

Q: What should organisations prioritise first in NHI governance?

A: Start with visibility, ownership, and privilege reduction. You cannot govern what you cannot enumerate, and you cannot contain what you have not scoped. After inventory, focus on eliminating long-lived secrets, mapping blast radius, and defining revocation triggers for offboarding, anomalies, and system changes.

Technical breakdown

Why NHI risk becomes decentralized in cloud and CI/CD environments

NHIs are often created close to the workload that uses them, not in a central identity directory. That means credentials, entitlements, and trust relationships are spread across pipelines, cloud services, vendor integrations, and automation layers. In practice, each of those places can become a separate source of truth, which weakens visibility and complicates lifecycle control. Once the identity estate is fragmented, governance depends on near-real-time discovery rather than periodic inventory and review cycles. Practical implication: build continuous NHI discovery and entitlement mapping across cloud and delivery pipelines.

Practical implication: build continuous NHI discovery and entitlement mapping across cloud and delivery pipelines.

How secret leakage and long-lived credentials create durable attack paths

Secret leakage matters because machine credentials are reusable, machine-readable, and often accepted without the user-context signals that protect human authentication. Long-lived secrets extend the compromise window, while overprivileged service accounts increase what an attacker can do after entry. The problem is not only where the secret is stored, but how long it remains valid and how much access it carries once exposed. In NHI environments, compromise is often a governance failure long before it becomes an intrusion. Practical implication: reduce standing exposure by tying secret validity to short-lived, auditable access patterns.

Practical implication: reduce standing exposure by tying secret validity to short-lived, auditable access patterns.

What OWASP-style risk ranking changes for identity teams

OWASP risk framing helps identity teams compare NHI issues against other security priorities using prevalence, exploitability, detectability, and impact. That matters because many organisations still treat machine identity controls as a narrow cloud task rather than a formal identity discipline. A ranked model gives practitioners a language for prioritising offboarding, rotation, privilege reduction, and visibility based on real exposure rather than ad hoc tooling decisions. Practical implication: use risk scoring to order remediation by exploitability and business impact, not by where the easiest controls already exist.

Practical implication: use risk scoring to order remediation by exploitability and business impact, not by where the easiest controls already exist.

Threat narrative

Attacker objective: The attacker aims to turn a leaked machine identity into durable, high-trust access that bypasses normal human authentication controls.

1. Entry occurs through exposed NHI credentials such as API keys, tokens, or service account secrets found in code, CI/CD systems, or external integrations.
2. Escalation follows when the compromised identity has excessive privileges, allowing the attacker to expand access across connected systems and workloads.
3. Impact results when the attacker uses that machine trust to reach sensitive resources, move laterally, or exfiltrate data without triggering human authentication workflows.

Breaches seen in the wild

• IOS app secrets leakage report — iOS apps leaking hardcoded secrets and credentials endangering user privacy.
• Cisco DevHub NHI breach — IntelBroker exploited exposed Cisco credentials, API tokens and keys in DevHub.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Decentralized NHI governance is the real control problem. The article correctly identifies that machine identities live across CI/CD, third-party services, and cloud workflows rather than inside a single authoritative directory. That decentralization breaks the assumption that identity governance can be handled from a central human IAM model. The implication is that discovery, entitlement mapping, and offboarding all need machine-speed execution, not human-cycle review.

Secret leakage is not just exposure, it is an identity lifecycle failure. The OWASP Top 10 framing is useful because it connects leakage to offboarding, rotation, and standing credential persistence. A secret that remains valid after notification or after role change is not merely a vulnerable credential, it is an unmanaged identity with an extended blast radius. Practitioners should treat leaked secrets as lifecycle defects, not isolated security events.

Overprivileged NHIs create the broadest practical blast radius. The article highlights excessive privilege as a recurring NHI risk, and that is where most organisations remain weakest. Machine identities are frequently provisioned for convenience and then left unchanged as workloads evolve, which means privilege accretion happens silently. The governance lesson is simple: access scope must be revalidated against actual workload need, or the identity estate becomes a standing lateral-movement layer.

OWASP-style ranking helps turn NHI risk into programme prioritisation. Security teams need a common method for deciding whether offboarding gaps, long-lived secrets, or vault misconfigurations come first in the remediation queue. A ranked model is valuable because it links prevalence to exploitability and impact, which is exactly how identity leaders should justify budget and sequencing. The practical conclusion is to use risk ranking to steer NHI remediation into the core IAM roadmap, not a side project.

Identity and machine security can no longer be separated operationally. The article’s human-and-machine framing is directionally correct because a compromised NHI often becomes the access path into systems also used by human users. That means privilege review, service account governance, and secret handling belong in the same control conversation as workforce IAM. The practitioner takeaway is to run one identity programme with actor-specific controls, not siloed human and machine processes.

From our research:

• 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to Ultimate Guide to NHIs.
• Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to Ultimate Guide to NHIs , Lifecycle Processes for Managing NHIs.
• For a deeper breach lens, the The 52 NHI breaches Report shows how persistent machine trust keeps turning into lateral movement and data exposure.

What this signals

Excess privilege and slow offboarding are now the default NHI failure pattern. When 97% of NHIs carry excessive privileges, the issue is no longer isolated misconfiguration but a structural governance gap that must be managed as part of core identity operations. Teams that still rely on periodic review will continue to miss short-lived, distributed machine access.

Identity programmes need machine-speed lifecycle controls, not just better inventories. The practical shift is from seeing NHIs as assets to treating them as governed identities with owners, expiry, and revocation obligations. That aligns with the lifecycle framing in Ultimate Guide to NHIs , Lifecycle Processes for Managing NHIs and with the risk logic in NIST Cybersecurity Framework 2.0.

Long-lived secrets create an identity blast radius that most programmes still underestimate. Once a secret can be copied into code, pipelines, and vendor integrations, remediation becomes a containment problem as much as an access problem. The result is that NHI governance must sit alongside secrets management, not underneath it.

For practitioners

• Inventory all NHIs across cloud and CI/CD pipelines Map service accounts, API keys, certificates, tokens, and workload roles to owners, systems, and expiry states. Prioritise places where identities are created outside the central IAM workflow, because those are the identities most likely to drift out of control.
• Classify and rotate long-lived secrets first Focus on credentials embedded in code, configuration files, automation scripts, and third-party integrations. Replace persistent credentials with shorter-lived equivalents and tie rotation to measured exposure windows rather than calendar convenience.
• Remove excessive privilege from machine identities Review service account entitlements against actual workload behaviour and remove permissions that are never exercised. Where possible, separate read, write, and administrative functions so compromise of one identity does not expose unrelated systems.
• Treat offboarding as a mandatory control, not an exception task Build explicit revocation steps for APIs, service accounts, and secrets when workloads are decommissioned, vendors change, or ownership shifts. The control should prove that the identity no longer authenticates anywhere before closure is accepted.
• Use risk ranking to prioritise remediation Sequence fixes by exploitability, privilege depth, and blast radius instead of by where the issue is easiest to see. That gives IAM and security leaders a defensible way to focus on the identities that would matter most in an incident.

Key takeaways

• NHI risk in this article is driven less by exotic attack techniques than by basic governance gaps in discovery, privilege, and offboarding.
• The strongest evidence points to excess privilege and slow revocation, which are the two conditions most likely to turn routine exposure into breach-scale impact.
• Identity teams should treat OWASP-style NHI prioritisation as a roadmap input, because machine identities now need continuous governance rather than periodic cleanup.

Key terms

• Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
• Secrets Leakage: Secrets leakage is the exposure of credentials such as API keys, tokens, or certificates in places where they can be discovered and reused. The risk is not just disclosure, but unauthorized authentication that turns a coding or pipeline mistake into active access.
• Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.
• NHI Offboarding: NHI offboarding is the controlled removal or reassessment of machine credentials when business ownership changes, work ends, or a system is retired. It extends human offboarding concepts to secrets, tokens, certificates, and service accounts that can otherwise remain active indefinitely.

What's in the full article

Saviynt's full blog covers the operational detail this post intentionally leaves for the source:

• The article's walkthrough of each OWASP NHI risk category and how Saviynt maps those categories into its platform.
• The specific product capabilities described for automated discovery, policy-based access controls, and lifecycle management.
• The vendor's own framing of how its identity cloud supports hybrid and multi-cloud NHI governance.
• The article's positioning of NHI governance alongside broader identity security and compliance workflows.

👉 Saviynt's full blog covers the OWASP NHI risk breakdown and its platform-level framing in more detail.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.