Notifications
Clear all
Topic starter
04/06/2026 6:43 pm
TL;DR: Broken NHI provisioning creates orphaned accounts, over-permissioned identities, and secrets that never rotate, while AI workloads and agentic architectures amplify the sprawl, according to Oasis Security. The real failure is treating provisioning as a one-time task instead of a lifecycle control point that establishes ownership, policy, and accountability from day one.
NHIMG editorial — based on content published by Oasis Security: What is Non Human Identity provisioning and why is it broken?
By the numbers:
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.
- 79% of organisations have experienced secrets leaks, with 77% of these incidents resulting in tangible damage.
Questions worth separating out
Q: What breaks when NHI provisioning is treated as a one-time task?
A: When provisioning is treated as a one-time task, organisations lose the metadata needed to govern the identity after creation.
Q: Why do poorly governed NHIs increase lateral movement risk?
A: Poorly governed NHIs often retain more access than they need and keep credentials active long after the original task changes.
Q: How do security teams know if NHI provisioning is actually working?
A: Provisioning is working when every identity is traceable from creation through retirement, with clear ownership, documented purpose, and enforced rotation.
Practitioner guidance
- Require lifecycle metadata at creation Make owner, purpose, system of record, and retirement condition mandatory before an NHI can receive credentials.
- Block credential issuance outside governed workflows Prevent developers and automation from minting production identities through ad hoc scripts, chat requests, or manual handoffs.
- Bind automation to policy, not tribal knowledge Translate common provisioning patterns into enforceable policy so least privilege, vaulting, and rotation are applied consistently across teams and environments.
What's in the full article
Oasis Security's full blog post covers the operational detail this post intentionally leaves for the source:
- A manual provisioning flow for Azure service principals with the specific handoffs and approval steps involved
- Concrete examples of broken provisioning patterns such as Slack-shared API keys, unrevoated secrets, and over-permissioned service accounts
- The article's proposed governance pattern for automating provisioning with policy enforcement, ownership assignment, and least privilege
- The vendor's perspective on how to scale NHI provisioning across hybrid and multi-cloud environments
👉 Read Oasis Security's analysis of why NHI provisioning is broken →
NHI provisioning is broken: where does governance fail first?
Explore further
04/06/2026 6:54 pm
Provisioning is the first governance decision, not an administrative step. The article is right to frame NHI provisioning as a foundational control point because the access model is effectively set before the identity ever enters production. If ownership, scope, and retirement conditions are absent at creation, every later control becomes compensating rather than preventive. For practitioners, the implication is that provisioning design determines downstream governance quality across IAM, PAM, and lifecycle.
A few things that frame the scale:
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to Ultimate Guide to NHIs.
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.
A question worth separating out:
Q: Who is accountable when an unowned NHI is left active?
A: Accountability should sit with the business service owner and the identity governance process that approved creation. If no owner can be identified, the organisation has a governance failure, not just a technical one. Frameworks such as the NHI lifecycle approach and zero trust both depend on proving who is responsible for an identity throughout its life.
👉 Read our full editorial: NHI provisioning is broken because governance starts too late
