Topic starter
25/08/2025 2:17 pm
TL;DR: GitGuardian says OWASP’s 2025 Non-Human Identity Top 10 formalises machine-identity risks such as secret leakage, improper offboarding, overprivileged NHIs, and insecure authentication at a time when NHIs can outnumber humans 100:1. The practical shift is that discovery, lifecycle control, and least privilege have to move into DevSecOps workflows because human-centric IAM assumptions no longer fit machine identities.
Editorial analysis by NHI Mgmt Group, based on content published by GitGuardian: “OWASP NHI Top 10 Risks for 2025 Explained by GitGuardian”.
By the numbers:
- NHIs can outnumber humans 100:1 in modern enterprises.
Key questions
Q: What breaks when non-human identities are not offboarded properly?
A: Orphaned NHIs remain valid long after the workload or integration they served is gone, which gives attackers a durable access path.
Q: Why do long-lived secrets create more risk for machine identities?
A: Long-lived secrets turn a one-time exposure into persistent access.
Q: How do security teams know if NHI governance is actually working?
A: A working NHI programme shows clear ownership, short-lived credentials, frequent revocation, and low numbers of dormant or shared machine accounts.
Practitioner guidance
- Inventory every machine identity and its owner Build a current register of service accounts, API keys, tokens, and certificates, then assign a named business and technical owner to each one.
- Tie secret detection to immediate revocation Treat every exposed credential as an active identity event by revoking, rotating, or disabling the secret as soon as it is found.
- Enforce least privilege at issuance time Scope each new machine identity to the minimum permissions it needs, then review any broad access before the credential enters production.
Bottom line: Machine identities behave like governed credentials, not like ordinary application artefacts, so ownership and lifecycle must be explicit.
What's in the full article
GitGuardian's full article covers the operational detail this post intentionally leaves for the source:
- The full OWASP NHI Top 10 breakdown, including the ten risk categories and how each one maps to machine identity governance.
- Examples of how GitGuardian positions discovery, secret analysis, and lifecycle visibility across real development workflows.
- The article's discussion of how NHI risks differ from traditional OWASP application security assumptions.
- The FAQ section's practical guidance on integrating NHI controls into DevSecOps pipelines.
👉 Read GitGuardian's analysis of the OWASP NHI Top 10 for machine identity risk →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
07/10/2026 6:23 pm
NHI governance failed because enterprises treated machine identities as implementation details rather than governed identities. The article shows that the problem is not only the number of NHIs, but the absence of clear ownership, lifecycle ownership, and entitlement discipline. Once a service account or API key is treated as disposable infrastructure, no one owns revocation, review, or retirement. The implication is that NHI governance has to become a named operating model, not an exception process.
A few things that frame the scale:
- Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems. Organisations failing to scope AI access properly are 4.5x more likely to experience a security incident, according to the 2026 Infrastructure Identity Survey.
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should teams embed NHI controls into DevSecOps without slowing delivery?
A: Place discovery, secret scanning, ownership checks, and privilege review at the points where code, configuration, and pipelines already change. That keeps the control close to creation and reduces the chance that machine identities escape into production without oversight. The aim is continuous governance, not after-the-fact cleanup.
👉 Read our full editorial: OWASP NHI Top 10 reframes machine identity risk for enterprises