Topic starter
13/10/2026 1:21 pm
TL;DR: P0 Security argues that static NHI credentials, including API keys, tokens and service-account passwords, persist as standing privilege because vaulting alone does not assign ownership, expiration, revocation or usage governance. The access lifecycle, not the storage location, is the control boundary that matters.
Editorial analysis by NHI Mgmt Group, based on content published by P0 Security: “Start Governing NHIs by Managing Access, Not Credentials”.
Key questions
Q: What breaks when organisations rely on scanners or vaults without full NHI governance?
A: Scanners and vaults solve only part of the problem if organisations do not also govern ownership, rotation, exposure, and offboarding.
Q: Why do static NHI credentials create more risk than human credentials in cloud environments?
A: Static NHI credentials are reusable, often high privilege, and usually lack the human controls that limit user accounts, such as MFA and session review.
Q: What are the signs that NHI credential governance is broken?
A: Common signs include secrets in repositories, repeated rotation work with no net reduction in exposure, unclear ownership across DevOps and security, and credentials that survive beyond the workload that was meant to use them.
Practitioner guidance
- Audit all static NHI credentials Build an inventory of API keys, tokens and service-account passwords across code, terraform, CI/CD and internal documents, then identify which ones still grant production access.
- Assign accountable ownership at creation Require every credential to have a named owner, a business purpose and an expiry or review date so that access can be revoked without ambiguity.
- Replace reusable secrets with federated access Use role assumption and identity federation where the workload supports it, so the system requests short-lived access instead of carrying a persistent secret.
Bottom line: Static credentials are the governance problem here, not just the storage problem, because they create access that persists without active ownership.
What's in the full article
P0 Security's full post covers the operational detail this post intentionally leaves for the source:
- A step-by-step maturity path for replacing static credentials with federated identity in production environments
- Specific guidance on using service control policies and CI/CD guardrails to stop new long-lived credentials
- The article's practical examples of how ownership assignment and JIT access fit into ongoing NHI governance
- The context behind why vaults help with storage but still fail to govern where secrets are actually used
👉 Read P0 Security's analysis of why NHI governance starts with access, not credentials →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
13/10/2026 1:22 pm
Vaulting is a storage control, not an NHI governance model: putting a secret in a vault reduces plaintext exposure but leaves ownership, expiry, revocation and usage entitlement unresolved. That separation matters because a credential can be protected at rest and still function as standing privilege in production. NHI governance starts only when the access grant is managed, not when the secret is stored.
A few things that frame the scale:
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to the Ultimate Guide to NHIs.
- 69% of organisations still authenticate machine identities with long-lived API keys, according to the 2026 State of AI Agent Identity Security Report.
A question worth separating out:
Q: How should security teams govern just-in-time access for non-human identities?
A: Security teams should treat JIT as a timing control, not a trust control. Require contextual checks on the issuer, workload, and requested resource before granting access, and define deny rules for identities that behave outside baseline patterns. That approach limits abuse while preserving production continuity.
👉 Read our full editorial: Governing NHIs by access, not credentials, is the real control shift