Notifications
Clear all
Topic starter
17/08/2026 4:40 pm
TL;DR: OWASP Top 10 NHI Risks for 2025 frames 10 recurring failure modes across service accounts, secrets, environment isolation, and human misuse of NHIs, according to Akeyless. The pattern is clear: NHI governance still lags human IAM, so standing access and shared credentials remain the real exposure points.
NHIMG editorial — based on content published by Akeyless: OWASP Top 10 NHI Risks for 2025 analysis
Questions worth separating out
Q: What breaks when service accounts are not offboarded after a project ends?
A: The identity remains valid long after the business need is gone, which leaves an orphaned entry point for attackers and a blind spot for audit teams.
Q: Why do reused machine identities increase breach impact?
A: Reuse makes one credential useful across multiple systems, so a single compromise can move from one workload to another without additional authentication barriers.
Q: How do security teams know when secret sprawl is becoming unmanageable?
A: When they cannot confidently answer where each secret exists, which workloads depend on it, and how quickly it can be retired without breaking business services.
Practitioner guidance
- Automate NHI offboarding at project closure Bind service account and key revocation to project and application retirement so orphaned identities cannot remain active after the work ends.
- Block hardcoded secrets before merge Use repository scanning, pipeline checks, and developer workflows that prevent API keys and tokens from being committed into source control.
- Separate identities by workload and environment Issue unique credentials for each application and environment so development, testing, and production do not share the same trust boundary.
What's in the full article
Akeyless's full article covers the operational detail this post intentionally leaves for the source:
- How its platform maps specific controls to each OWASP NHI risk category across offboarding, secrets, and access boundaries.
- The exact runtime handling patterns for injecting and rotating credentials in CI/CD and cloud environments.
- The machine identity and secrets management workflows that support environment isolation and workload-specific access.
- The implementation detail behind zero-knowledge secret handling and policy enforcement in hybrid deployments.
👉 Read Akeyless's analysis of the OWASP Top 10 NHI Risks for 2025 →
OWASP NHI Top 10: what are teams missing in machine identity control?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
17/08/2026 4:45 pm
Orphaned NHI ownership is the governance failure that turns temporary access into permanent exposure. The article's offboarding problem is not a housekeeping issue, it is a control failure in identity lifecycle management. When a service account survives the project that created it, the organisation has effectively allowed access to persist without a living owner. That is the exact condition attackers exploit, and it is why NHI governance must treat retirement as a control boundary, not an administrative task.
A few things that frame the scale:
- 88.5% of organisations acknowledge that their non-human IAM practices lag behind or are merely on par with their human identity and access management efforts, according to the 2024 Non-Human Identity Security Report.
- Only 23.7% of organisations share secrets through insecure methods such as email or messaging applications, which still leaves a meaningful exposure path for machine identities.
A question worth separating out:
Q: Who is accountable when administrators use service account credentials manually?
A: Both IAM and PAM teams need to own the boundary, because human actions taken through machine credentials break traceability. The right model is separate human authentication, separate machine authentication, and clear logging that preserves person-level accountability even when a service account is involved.
👉 Read our full editorial: OWASP NHI risks expose gaps in machine identity governance
