Topic starter
01/12/2025 12:25 pm
TL;DR: GitGuardian’s analysis of OWASP’s 2025 Top 10 shifts emphasis toward broken access control, security misconfiguration, and broader software supply chain failures, with GitGuardian highlighting how those changes map directly to exposed NHIs, secrets sprawl, and build-chain risk. NHI governance now sits closer to the centre of application security because access assumptions, not just code defects, are driving the blast radius.
Editorial analysis by NHI Mgmt Group, based on content published by GitGuardian: “OWASP Top 10 2025 Updates: Supply Chain, Secrets, And Misconfigurations Take Center Stage”.
Key questions
Q: What breaks when NHIs are given more access than their job needs?
A: The control that breaks is containment.
Q: Why do misconfigurations matter so much in NHI governance?
A: Misconfigurations matter because they define the trust boundary for secrets, roles, and cloud access.
Q: What are the signs that supply chain access is becoming risky?
A: Warning signs include credentials present in source control, build systems that reuse long-lived tokens, and deployment paths that can reach production with little separation of duties.
Practitioner guidance
- Inventory every non-human identity that can reach code or infrastructure Map service accounts, CI tokens, API keys, and deployment secrets to the systems they can touch, then remove identities that no longer have a clear owner or use case.
- Reassess access scope for build and deployment credentials Compare actual permissions against the narrowest task each identity must perform, and flag any credential that can read, modify, or deploy beyond its intended pipeline stage.
- Treat misconfiguration as an identity exposure signal Review cloud roles, secret storage settings, and default permissions together, because each can turn a credential leak into a larger access-control failure.
Bottom line: The 2025 OWASP update shifts attention from isolated code flaws toward access, configuration, and supply chain conditions that routinely involve NHIs.
What's in the full article
GitGuardian's full article covers the operational detail this post intentionally leaves for the source:
- How GitGuardian maps the OWASP 2025 categories to concrete NHI governance use cases
- Examples of how exposed secrets in CI and source control become access-control problems
- Details on GitGuardian's honeytokens as tripwires for supply chain compromise
- The vendor's reasoning behind prioritisation of broken access control, misconfiguration, and supply chain risk
👉 Read GitGuardian’s analysis of the OWASP Top 10 2025 shifts in NHI and supply chain risk →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
07/10/2026 6:21 pm
OWASP’s 2025 Top 10 is increasingly an identity governance document in disguise: the categories that matter most now describe how access is granted, mis-granted, or preserved across software delivery. That shift pulls NHI governance out of the supporting cast and into the centre of application security. Practitioners should read the ranking as a signal that access scope is becoming the primary control surface.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
- 73% of vaults are misconfigured, leading to unauthorised access and exposure of sensitive data, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should teams govern secrets in infrastructure as code pipelines?
A: Teams should keep secrets out of code and move them into a dedicated runtime secrets service, then enforce policy that prevents repository storage and console exposure. The goal is to make credential lifecycle controls independent from the IaC repository, so revocation, rotation, and access review can happen without editing infrastructure templates.
👉 Read our full editorial: OWASP top 10 2025 shifts NHI and supply chain risk