Topic starter
13/05/2026 2:08 pm
TL;DR: Hardcoded secrets, logs and collaboration tools continue to expose API keys, tokens and machine credentials, widening the NHI attack surface and enabling unauthorized access, lateral movement and data loss across cloud and development workflows, according to Entro Security. Secrets governance now matters as much as detection because exposed credentials outlive the moment they are leaked.
Editorial analysis by NHI Mgmt Group, based on content published by Entro Security: “NHI Threats & Mitigation Part 1: Secrets Exposure”.
By the numbers:
- NHIs and secrets outnumber human identities by 92X in the environments Entro Security describes.
Key questions
Q: What breaks when exposed secrets in chat tools are not monitored in real time?
A: Without real-time monitoring, exposed secrets can remain live long enough for attackers or insiders to use them before anyone notices.
Q: Why do leaked NHI secrets so often lead to lateral movement?
A: Because many leaked credentials are still valid and often carry more privilege than the original task required.
Q: How do security teams know when secrets exposure in cloud instances is becoming a real incident?
A: The clearest signs are unexpected access to instance metadata, discovery of secrets in launch parameters or user data, and evidence that those secrets were used beyond the original workload.
Practitioner guidance
- Map secret exposure paths across teams Inventory where API keys, tokens, service account credentials and certificates can appear outside the vault, including source control, build logs, tickets and chat tools.
- Block credential storage in collaboration tools Use redaction, DLP and workflow controls so Slack, Jira, Confluence and similar platforms cannot carry secrets as durable records.
- Reduce standing secret lifetime Rotate exposed secrets quickly, expire unused credentials and remove any shared secret that still grants access after its original purpose has ended.
Bottom line: Secrets exposure becomes an identity problem when credentials are reusable outside the system that issued them.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
13/05/2026 2:08 pm
Secrets exposure is an identity control failure before it is a detection problem. Once a credential is copied into code, logs or chat, the environment has effectively created a second, unmanaged copy of a non-human identity secret. That copy often persists longer than the business task that produced it, which means the attack surface is governed by retention and reach, not just by whether scanning is enabled. The practitioner conclusion is that secret custody must be treated as part of identity lifecycle control.
A few things that frame the scale:
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to the Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should organisations prioritise secret rotation or access review first
A: They should do both, but access review should come first when unknown or over-privileged identities already exist. Rotation reduces exposure window, but review reduces entitlement sprawl and clarifies ownership. If a team rotates secrets without fixing who can use them, it preserves the same risk pattern with a fresher credential.
👉 Read our full editorial: Secrets exposure is widening the NHI attack surface across teams