Secrets management and MITRE ATT&CK: closing NHI attack paths

At a glance

What this is: This is a high-level analysis of how secrets management maps to MITRE ATT&CK, with the key finding that machine identity growth and static credentials expand the attack surface faster than most governance models can absorb.

Why it matters: IAM, PAM, and NHI teams need to treat secrets sprawl as an attack-path problem, because credential exposure, privilege escalation, and lateral movement are still the common route from access to breach.

By the numbers:

• For every human identity, there are 45 machine identities, and that ratio will more than double in the next 18 months.
• 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, sharing sensitive data, and revealing credentials.
• 17 minutes and as quickly as 9 minutes

👉 Read Akeyless's analysis of secrets management and MITRE ATT&CK mapping

Context

Secrets management is the discipline of controlling credentials, tokens, certificates, and API keys across the systems that use them. In a machine-heavy environment, that discipline becomes the boundary between normal service communication and attacker reuse of standing access. This article frames that problem through MITRE ATT&CK and the growth of NHI sprawl.

The central governance gap is that machine identities now outnumber human identities by a wide margin, while many enterprises still treat secrets as deployment artefacts rather than governed identities. That model fails once attackers can harvest a credential and use it across initial access, privilege escalation, and exfiltration.

For identity programmes, the issue is not whether secrets exist. It is whether their lifecycle, scope, and revocation are managed with the same seriousness as human access, especially as LLM adoption and agentic AI increase the number of non-human actors.

Key questions

Q: What breaks when machine identities rely on bearer secrets?

A: Bearer secrets can be replayed once exposed, so possession of the token becomes enough to act. That breaks the assumption that machine access remains tied to the intended holder, which is why sender-constrained proof-of-possession controls matter for service accounts and automated workflows.

Q: Why do service accounts with standing privilege increase lateral movement risk?

A: Standing privilege expands the blast radius of one compromised identity. When a service account can read, write, or administer more systems than it needs, attackers inherit that scope immediately. The risk is highest in cloud and SaaS environments where privileges are often broad and inconsistently reviewed.

Q: How do security teams know whether secret rotation is actually working?

A: Rotation is working only if exposed credentials are found quickly, revoked everywhere they are used and replaced before attackers can reuse them. If a secret remains valid after exposure, or if owners cannot prove where it was deployed, rotation is only reducing exposure on paper. The signal to watch is not the rotation schedule, but the time from leak to invalidation.

Q: What frameworks should guide NHI secrets governance?

A: OWASP-NHI, NIST Cybersecurity Framework, and Zero Trust Architecture are the most relevant starting points for machine identities and secrets. They help teams connect credential lifecycle, access scope, and continuous verification to actual operating controls rather than treating secrets management as a storage problem.

Technical breakdown

How secrets map to MITRE ATT&CK initial access

Secrets that are embedded in code, stored in CI/CD, or reused across environments create a direct route into enterprise systems. In ATT&CK terms, they support Initial Access because the attacker does not need to break authentication, only reuse it. The same credential pattern also becomes a discovery asset once access is obtained, because secrets often reveal adjacent systems, services, and trust relationships. Dynamic secrets and short-lived tokens reduce the value of any one compromise, but only if the issuance and revocation model is consistent across all workloads.

Practical implication: inventory where static secrets are exposed and reduce their usable lifetime before attackers can reuse them.

Why standing privilege turns credential theft into escalation

A stolen secret is far more dangerous when it maps to persistent permissions. Standing privilege means the credential remains valid beyond the task it was created for, so an attacker can move from authentication into privilege escalation without needing another user interaction. RBAC helps only when roles are tightly scoped and regularly reviewed, while JIT access limits how much privilege exists at any one time. If secrets are broadly reusable, the control failure is not the vault itself but the persistence of privilege behind the secret.

Practical implication: tie every high-risk secret to a least-privilege role and remove persistent entitlements from service accounts.

How secrets rotation and secretless patterns reduce lateral movement

Rotation changes the attacker’s window, not just the defender’s housekeeping cadence. When credentials are automatically refreshed and constrained to a narrow trust domain, lateral movement becomes harder because compromise in one path does not guarantee reuse elsewhere. Secretless patterns go further by replacing stored secrets with ephemeral identity exchanges such as SPIFFE and workload attestation. That shifts the control point from secret storage to runtime identity proof, which is where machine communication increasingly happens.

Practical implication: use rotation and workload identity together so a stolen secret cannot travel across systems.

Threat narrative

Attacker objective: The attacker’s objective is to turn one compromised machine secret into durable access across multiple systems and services.

1. Entry occurs when attackers obtain exposed or reused machine credentials from code repositories, CI/CD systems, or public-facing infrastructure.
2. Escalation follows when the credential carries standing privilege, allowing access to more systems than the originating workload actually needs.
3. Impact occurs through lateral movement, persistence, and data exfiltration as the attacker reuses the same trust relationship across the environment.

Breaches seen in the wild

• Sisense breach — unauthorized GitLab access led to exfiltration of access tokens, API keys and certificates.
• IOS app secrets leakage report — iOS apps leaking hardcoded secrets and credentials endangering user privacy.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Secrets management is becoming the control plane for machine identity governance. As LLMs and agentic AI increase the number of service accounts, API keys, and certificates in circulation, secrets handling stops being a plumbing issue and becomes an identity discipline. The practical implication is that organisations must treat every secret as a governed identity with lifecycle, scope, and audit requirements.

Standing privilege is the failure mode that matters most in credential-led attacks. A credential that remains valid after issuance creates a reusable bridge from initial access to lateral movement. That is why dynamic secrets, narrow RBAC, and JIT are not separate topics but one control pattern for shrinking the attacker’s usable window.

Dynamic credentials only work when the surrounding governance model can actually absorb the churn. Rotation without ownership, inventory, and revocation logic simply moves stale access from one store to another. The implication is that identity programmes need a single view of workload entitlement, not isolated secret stores managed by different teams.

Machine identity growth exposes a trust-density problem, not just a volume problem. The 45:1 ratio is less important than the fact that every additional workload multiplies trust edges, approval paths, and revocation dependencies. That means the attack surface expands faster than manual review can track, so governance has to be continuous rather than periodic.

Secretless architectures sharpen the distinction between authentication and authorisation. When workloads rely on attested runtime identity instead of stored credentials, the real control question becomes whether the workload is trusted to act now, not whether a token was handed out earlier. Practitioners should use that distinction to redesign how machine trust is granted and revoked.

From our research:

• The average enterprise already has more than 100 times as many machine identities as human identities in some environments, according to the Ultimate Guide to NHIs.
• Machine identity sprawl is also visible in breach data, where credential exposure repeatedly appears as the entry point rather than the end state.
• That is why 52 NHI Breaches Analysis remains the most useful forward reference for teams trying to turn inventory into control.

What this signals

Machine identity governance is moving from periodic review to runtime control. As secrets populations grow faster than manual processes can track them, teams need continuous visibility into who or what can authenticate, where, and for how long. The next maturity step is not more inventory alone, but tighter coupling between issuance, use, and revocation.

Identity blast radius will become the key metric for non-human access programmes. If a stolen secret can still reach multiple workloads, the control model has already failed. Teams should measure how far one compromised credential can travel across environments, then reduce that reach through short-lived trust and narrower scopes.

In practice, that means joining workload identity, secrets hygiene, and Zero Trust into one operating model rather than three separate initiatives. The organisations that do this well will be able to absorb AI-driven growth without turning every new workload into a new compromise path.

For practitioners

• Classify every secret as an identity asset Map service accounts, API keys, tokens, and certificates into the same governance inventory used for human access. Assign ownership, business purpose, expiration, and revocation criteria so the secret cannot exist outside a managed lifecycle.
• Reduce standing privilege on all machine accounts Review workload roles for persistent permissions that outlive the task they support. Replace broad, reusable access with task-scoped roles and JIT issuance for high-risk operations.
• Shorten the exposure window for exposed credentials Automate rotation for secrets with any external or shared exposure path, especially those in CI/CD, code repositories, and cloud configuration. Pair rotation with immediate revocation paths so stale credentials do not remain usable after replacement.
• Move high-risk workflows toward secretless identity Where workloads can support it, replace stored long-lived secrets with attested workload identity and ephemeral credentials. Use SPIFFE or equivalent patterns for machine authentication where runtime trust can be proven without preserving a reusable secret.

Key takeaways

• The article’s core warning is that machine identity growth is outpacing the controls used to govern secrets, which makes credentials a primary breach path.
• Its strongest operational point is that standing privilege, not just secret exposure, determines how far an attacker can move once a credential is stolen.
• The practical response is to shrink credential lifetime, remove persistent access, and treat machine secrets as governed identities rather than deployment artefacts.

Key terms

• Machine Identity: The digital identity of a machine, device, or workload — such as a server, container, or VM — used to authenticate it within a network. Sometimes used interchangeably with NHI, though NHI is the broader category.
• Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.
• Dynamic Secret: A secret generated on-demand for a specific task and automatically revoked after use or expiry. Dynamic secrets dramatically reduce the risk of credential exposure compared to static, long-lived secrets and are considered best practice.
• Secretless architecture: A secretless architecture is a model where applications and workloads authenticate with identity instead of handling reusable credentials directly. The secret may still exist in the system, but it is issued, used, and revoked behind the scenes so the workload never sees it.

What's in the full article

Akeyless's full blog covers the operational detail this post intentionally leaves for the source:

• The article’s ATT&CK mapping examples for initial access, privilege escalation, and exfiltration.
• The product-specific explanation of dynamic secrets, RBAC, JIT access, and secretless architecture.
• The white paper download referenced in the post, which goes deeper into the implementation narrative.
• The vendor’s demo path for teams that want to inspect the platform workflow directly.

👉 Akeyless's full post covers the ATT&CK lifecycle mapping, secrets management examples, and the companion white paper.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.