Topic starter
10/06/2026 11:01 pm
TL;DR: AI key inventories are fragmenting across OpenAI, Anthropic, Google Cloud, and AWS dashboards, leaving stale, unused, and orphaned credentials easy to miss, according to Riptides. The governance gap is not visibility alone, but the absence of lifecycle control over issued AI keys before they become exposure points.
Editorial analysis by NHI Mgmt Group, based on content published by Riptides: “Introducing KeyLedger: Because You Probably Don't Know How Many AI Keys Your Org Has”.
Key questions
Q: What breaks when AI keys are managed only in provider dashboards?
A: Governance breaks because no single dashboard contains the full credential story.
Q: Why do AI provider keys become a bigger risk as environments scale?
A: Every new provider, workspace, and integration adds another place where keys can be issued and forgotten.
Q: How do security teams know if AI governance is working?
A: Look for evidence that access decisions are reviewable, permissions are revocable, and exceptions are not becoming permanent.
Practitioner guidance
- Build a unified AI key inventory Aggregate keys across OpenAI, Anthropic, Google Cloud, AWS, and any other providers into one governed inventory with owner, workspace or project, creation time, status, and last-used data.
- Treat missing usage data as risk Flag keys without reliable last-used telemetry as unresolved until a human or policy process can confirm their purpose, because partial telemetry can hide dormant exposure.
- Separate experiment keys from production keys Assign distinct ownership and revocation rules for proof-of-concept credentials so temporary AI work does not inherit production persistence.
Bottom line: AI provider keys are proliferating across separate dashboards faster than teams can govern their lifecycle.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 days ago by NHI Mgmt Group
12/06/2026 4:48 am
AI key sprawl is an NHI lifecycle failure, not a dashboard problem. The hard part is no longer creating credentials but proving where they exist, who owns them, and when they should be revoked. Multiple provider consoles create fragmented evidence, which makes recertification and offboarding incomplete by design. Practitioners need to treat the credential estate as a governed inventory, not a set of isolated admin screens.
A few things that frame the scale:
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should organisations rotate AI keys before or after building a unified inventory?
A: Before and after are both necessary, but inventory comes first. Without a trusted list of issued keys, rotation becomes guesswork and can miss dormant credentials or break active ones. Once the inventory exists, rotation can be risk-based instead of blind.
👉 Read our full editorial: AI key sprawl is outpacing governance across provider dashboards
This post was modified 2 days ago by NHI Mgmt Group