Secrets management and MITRE ATT&CK: closing NHI attack paths

At a glance

What this is: This is Akeyless’s analysis of how secrets management maps to MITRE ATT&CK, with the central finding that machine identity growth and static credentials expand attacker pathways.

Why it matters: It matters because IAM, PAM, and NHI teams need to reduce standing secret exposure, tighten privilege scope, and align controls to attacker stages rather than treating secrets as a vault-only problem.

By the numbers:

• For every human identity, there are 45 machine identities today, and this will more than double in the next 18 months.

👉 Read Akeyless's analysis of secrets management and MITRE ATT&CK for NHI attack paths

Context

The core problem is not secrets management in isolation, but the widening identity surface created by non-human identities, service workloads, and AI-driven systems that depend on credentials to operate. When the ratio of machine identities to human identities climbs this quickly, the governance question shifts from storing secrets safely to controlling how and where those credentials can be used.

MITRE ATT&CK gives security teams a common way to map attacker stages to defensive controls, but that only helps if secrets governance is tied to those stages in practice. For IAM, PAM, and NHI programmes, the useful question is whether credential issuance, rotation, and privilege scope actually reduce initial access, credential theft, escalation, and lateral movement.

The article’s starting position is typical for modern machine-identity risk: credentials remain the operational glue of infrastructure, but they also remain one of the easiest paths for attackers to abuse. That makes the issue structural, not cosmetic.

Key questions

Q: What breaks when shared machine secrets are not removed from the operating model?

A: What breaks is not just storage discipline but the trust model itself. Shared secrets can be copied into code, logs, pipelines, and workstations, which makes ownership diffuse and revocation incomplete. That leaves workloads authenticating through credentials that are easy to expose and hard to retire cleanly.

Q: Why do static credentials increase the blast radius of a compromise?

A: Static credentials increase blast radius because they remain valid across multiple sessions and often carry permissions broader than a single task. Once discovered, they can be reused for escalation, lateral movement, or persistence. The risk rises sharply when the credential is shared, embedded, or difficult to revoke quickly.

Q: How do identity teams know whether secrets governance is actually working?

A: Identity teams know secrets governance is working when they can prove that every active secret has an owner, an approved scope, and a tested revocation path. If they cannot quickly identify where a secret is used or remove it without breaking the workload, governance is still incomplete.

Q: How should IAM teams use ATT&CK when hardening NHI controls?

A: Use ATT&CK as the translation layer between identity controls and adversary behaviour. Map where credentials enable initial access, where privilege expands, and where lateral movement becomes possible, then align each stage to a control owner. That makes secrets management a detection and containment strategy, not only a compliance activity.

Technical breakdown

How secrets become attack paths

Secrets such as passwords, API tokens, certificates, and keys are not just storage objects. They are runtime trust artefacts that let one system prove it may act as another. In machine-to-machine environments, that trust is often persistent and broadly reusable, which means a single exposed credential can support initial access, persistence, privilege escalation, and lateral movement. MITRE ATT&CK is useful here because it maps attacker behaviour to those stages instead of treating compromise as a single event. The key architectural weakness is standing secret validity: the longer a credential can be replayed, the more attack stages it can support.

Practical implication: Treat every reusable secret as a potential attack path and map its exposure window to ATT&CK stages.

Why dynamic secrets and JIT change the privilege model

Dynamic secrets are temporary credentials issued for a limited task or session, and JIT access provisions privilege only when it is needed. Together, they reduce the amount of time an attacker can reuse a stolen credential and shrink the period in which standing privilege exists. This is not the same as simply rotating a password on a schedule. The control shift is from durable identity trust to ephemeral, scoped authorisation. In NHI terms, that matters because machine identities often operate without human intervention and therefore need controls that expire with the task, not with a calendar.

Practical implication: Use time-bounded credential issuance and task-scoped access instead of relying on periodic rotation alone.

RBAC only works when the privilege boundary is real

RBAC limits what a secret can do, but only if roles are narrowly defined and mapped to actual machine functions. In many environments, service accounts accumulate broad permissions because teams optimise for operational convenience, not for runtime containment. That turns RBAC into a paper control: the role exists, but the blast radius remains large. The article’s reference to granular RBAC is important because it points to a more precise identity model for NHIs, where each workload gets only the permissions required for its function. Without that, compromised secrets still become a route to escalation and movement.

Practical implication: Review NHI roles by workload function and remove broad role grants that survive beyond the task they support.

Threat narrative

Attacker objective: The attacker wants to turn one exposed machine secret into repeatable access across internal systems and workloads.

1. Entry occurs when attackers obtain exposed or reused machine credentials that are valid across infrastructure systems and services.
2. Credential access follows when those secrets are harvested from poorly governed stores, pipelines, or endpoints.
3. Escalation and lateral movement occur when the stolen credential carries broader access than the workload actually needs.
4. Impact is achieved when the attacker uses the trusted identity path to reach additional systems, persist, or exfiltrate data.

Breaches seen in the wild

• AI agent retail card theft campaign 2026: AI agents breached 27+ retailers for about $25 each, used cloud keys and a Secrets Manager dump, and stole 600,000+ payment cards.
• LiteLLM PyPI package breach: LiteLLM PyPI supply chain attack, credentials stolen from users.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Secrets management is now an attack-path control, not just a vaulting discipline. The article is right to place ATT&CK alongside secrets management because the central problem is not storage alone but adversary replayability across infrastructure stages. Once a secret can be reused across workflows, the control question becomes how much of the attack lifecycle it can still support. Practitioners should treat credential lifecycle as a defensive boundary, not a back-office process.

Machine identity growth turns standing privilege into the default breach enabler. The 45-to-1 ratio is not just a scale statistic; it shows why manual secrets governance no longer keeps pace with operational reality. When machine identities outnumber human users so heavily, every unmanaged secret increases the probability that an attacker will find a viable path through one of many service accounts or tokens. The implication is that NHI governance must be designed for volume, not exception handling.

Zero standing privilege is the right lens for machine credentials. Dynamic secrets and JIT access matter because they reduce the lifetime of usable privilege, which is the real constraint in credential-based attacks. Long-lived secrets and broad roles are what keep the ATT&CK chain intact. Practitioners should measure whether a secret can survive long enough to be reused, not just whether it is stored securely.

ATT&CK mapping only works when teams map identity controls to adversary behaviour. A framework vocabulary is useful only if it changes detection and containment priorities. This article points in the right direction by linking initial access, credential access, escalation, and lateral movement to concrete secrets controls. The field needs more of this translation layer so that IAM, PAM, and SOC teams can work from the same threat model.

Secretless architectures deserve more attention than rotation alone. The mention of SPIFFE and secretless approaches reflects a deeper trend: some machine-to-machine trust problems are better solved by reducing secret dependency than by endlessly rotating it. That does not remove the need for governance, but it changes where the control boundary sits. Practitioners should evaluate whether their architecture still assumes long-lived shared secrets when workload identity could remove them.

From our research library:

• 62% of organisations are at least experimenting with AI agents, but only 23% have scaled one into a single business function, according to McKinsey's 2025 State of AI survey.
• Read next: Agentic AI Identity Guide

What this signals

Credential replayability is the real secrets-management problem. When a machine identity can keep using the same credential across sessions, the control objective is no longer simple protection at rest. It becomes limiting how long that trust remains usable in practice, which is why JIT, dynamic secrets, and workload identity matter more than vault placement alone.

Secrets governance must be designed for machine scale. The article’s 45-to-1 ratio already signals a governance mismatch, and the problem compounds as AI systems expand the number of credentials in circulation, according to the 2026 Infrastructure Identity Survey. Teams that still treat NHI oversight as a special case will keep finding that exposure arrives faster than review cycles can respond.

For practitioners

• Map secrets to ATT&CK stages Inventory the machine secrets that can support initial access, credential access, escalation, and lateral movement, then rank them by the attack stages they can enable.
• Replace standing secrets with dynamic issuance Prioritise workloads where a static credential can be swapped for short-lived, task-scoped access so that compromise has less time to propagate.
• Tighten NHI role boundaries Review service-account and application roles for unnecessary privileges, especially where one credential can reach multiple systems or environments.
• Reduce secret reuse across environments Eliminate shared credentials between pipelines, staging, and production so a single exposed value cannot unlock multiple trust zones.
• Assess secretless workload identity options Where workloads exchange credentials frequently, evaluate whether workload identity patterns can remove the need for reusable secrets altogether.

Key takeaways

• Machine identities create a much larger credential surface than human accounts, and static secrets keep that surface exploitable for longer than most programmes can tolerate.
• Mapping secrets management to ATT&CK is useful because it ties credential governance to concrete attacker stages rather than generic risk language.
• Dynamic issuance, stricter role boundaries, and secretless workload identity are the controls that change the economics of credential-based intrusion.

Key terms

• Dynamic Secret: A secret generated on-demand for a specific task and automatically revoked after use or expiry. Dynamic secrets dramatically reduce the risk of credential exposure compared to static, long-lived secrets and are considered best practice.
• Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.
• Credential Replayability: Credential replayability is the degree to which a stolen or exposed credential can still be used successfully after compromise. High replayability means revocation is slow, scope is too broad, or authentication accepts the secret without enough contextual checks.
• Workload Identity: The identity assigned to a software workload, such as a containerised application, serverless function, or microservice, enabling it to authenticate to other services without storing static credentials.

What's in the full article

Akeyless's full blog post covers the operational detail this post intentionally leaves for the source:

• The ATT&CK stage-by-stage examples that show where secrets management interrupts attacker progression
• The white paper’s 16 pages of practical guidance on mapping controls to credential-based attack paths
• The platform-specific explanation of dynamic secrets, RBAC, and JIT access in the source article
• The secretless and SPIFFE discussion that expands beyond the high-level governance view

👉 Akeyless's full post covers the ATT&CK lifecycle mapping, dynamic secrets, and secretless guidance in more detail.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.