Topic starter
13/05/2026 8:55 pm
TL;DR: Many organisations still cannot see how many non-human identities and associated secrets they have, leaving service accounts, API keys, OAuth tokens, vaults, CI/CD pipelines and collaboration tools as hidden exposure points, according to Entro Security. Continuous discovery and behavioural context are now required because point-in-time scanning cannot keep pace with secret sprawl.
Editorial analysis by NHI Mgmt Group, based on content published by Entro Security: “Non-human identities: discovery and inventory”.
By the numbers:
- 79% of organisations have experienced secrets leaks, with 77% of these incidents resulting in tangible damage, according to the Ultimate Guide to NHIs.
Key questions
Q: What breaks when non-human identity discovery is only done periodically?
A: Periodic discovery leaves service accounts, API keys, and tokens invisible between scans, which means teams lose track of where secrets move and who still depends on them.
Q: What problem does ownership attribution solve for service accounts and API keys?
A: It closes the gap between exposure detection and accountable remediation.
Q: How do security teams know if NHI controls are actually working?
A: Look for complete inventory coverage, clear ownership, enforced rotation, and evidence that unused credentials are removed on time.
Practitioner guidance
- Build continuous NHI discovery coverage Scan cloud vaults, repositories, CI/CD systems, collaboration platforms, and runtime environments on an ongoing basis so hidden secrets are not left to periodic audits.
- Correlate secrets with their usage paths Track where each credential is stored, where it is injected, and which services or workflows consume it so the inventory reflects actual exposure, not only storage locations.
- Prioritise high-blast-radius identities first Focus remediation on production service accounts, inherited cloud roles, and tokens with broad delegation because those identities create the largest downstream impact if discovered or abused.
Bottom line: Hidden secrets across cloud, code, pipelines, and collaboration tools make NHI inventory incomplete unless discovery follows credentials continuously.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 week ago by NHI Mgmt Group
13/05/2026 8:56 pm
Continuous discovery is now the minimum viable control for NHI governance. The article’s central point is that secrets no longer live in a single vault or repository, so periodic scans miss the real attack surface. That matters because discovery failures are lifecycle failures: if a team cannot continuously locate service accounts and machine credentials, it cannot govern ownership, exposure, or revocation with any confidence. The practitioner conclusion is clear: inventory has to move from project activity to standing control.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should teams handle secrets found in CI/CD logs or collaboration tools?
A: They should treat those locations as first-class secret sources, not side channels. If detection only covers repositories, secrets pasted into logs, chat, ticketing, or document systems will stay invisible even though they can still grant access. Coverage has to follow where developers actually work.
👉 Read our full editorial: Non-human identity discovery and inventory still miss hidden secrets
This post was modified 1 week ago by NHI Mgmt Group