Topic starter
17/08/2026 4:40 pm
TL;DR: Akeyless argues that the OWASP Top 10 Non-Human Identity Risks for 2025 surfaces recurring failures across service accounts, secrets, environment isolation and human misuse of NHIs, showing that standing access and shared credentials still drive exposure. The governance gap is not visibility alone but lifecycle control over identities that never behave like human users.
Editorial analysis by NHI Mgmt Group, based on content published by Akeyless: “Securing Non-Human Identities: How Akeyless Protects Against the OWASP Top 10 NHI Risks in 2025”.
Key questions
Q: What breaks when non-human identities are not offboarded properly?
A: Orphaned NHIs remain valid long after the workload or integration they served is gone, which gives attackers a durable access path.
Q: Why do leaked secrets and reused service accounts create so much risk?
A: A leaked secret is an active credential, not just evidence of exposure, and reused service accounts can open multiple applications or environments at once.
Q: How should security teams separate machine identities across environments?
A: Give each environment and each application its own identity, policy and secret set so a compromise in development cannot automatically reach production.
Practitioner guidance
- Map every service account to a named owner and expiry rule Require a business or platform owner for each machine identity, and tie deactivation to project closure, workload retirement or vendor offboarding.
- Remove secrets from static code and configuration files Move API keys and tokens out of repositories, build files and deployment configs, then inject them at runtime from governed secrets storage.
- Separate identities by environment and application Issue distinct credentials and policies for development, testing and production, and avoid any shared service account across applications.
Bottom line: The article frames NHI risk as a governance problem centred on service accounts, secrets and automation credentials that remain active beyond their intended use.
What's in the full article
Akeyless' full analysis covers the operational detail this post intentionally leaves for the source:
- The full OWASP NHI Top 10 breakdown across all ten risk categories and the examples used for each one
- A closer look at how Akeyless maps its secrets and machine identity platform to each NHI risk
- The article's scenario-level discussion of service accounts, API keys and environment isolation in a cloud workflow
- The concluding framing on why the NHI risk model matters for automated access governance
👉 Read Akeyless' analysis of OWASP NHI risks and machine identity governance →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
17/08/2026 4:45 pm
Machine identity governance fails when organisations treat non-human identities as temporary implementation details. The article shows the opposite: service accounts, API keys and automation credentials are now production access paths, not incidental plumbing. Once those identities outlive the project, they become unmanaged trust anchors. Practitioners need to stop assuming machine access is low-risk simply because no person is typing the password.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
- 68% of organisations do not know how to fully address NHI risks, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: When does human use of service accounts become an accountability problem?
A: It becomes an accountability problem the moment a person uses a machine credential for manual work, because actions are no longer cleanly tied to an individual identity. That breaks traceability during investigations and weakens approval and review processes. Human access and machine access need separate paths.
👉 Read our full editorial: OWASP NHI risks expose gaps in machine identity governance