Topic starter
07/06/2026 8:17 pm
TL;DR: Traditional NHI risk scores can improve even as static API keys, service accounts, and hardcoded credentials continue to multiply, so the dashboard looks better while attack surface expands, according to Clutch Security. The real governance problem is not only fixing today’s findings, but measuring whether the identity architecture is actually moving toward less static credential exposure.
Editorial analysis by NHI Mgmt Group, based on content published by Clutch Security: “Why We Built Two Scores: Introducing Zero Trust Scoring for Non-Human Identities”.
Key questions
Q: How can security teams tell whether NHI governance is working?
A: They should look for fewer orphaned accounts, shorter credential lifetimes, lower secret reuse and faster decommissioning when systems or projects end.
Q: Why can a better risk score still mean higher identity exposure?
A: Because a risk score can improve when existing problems are fixed even if new static credentials are being added faster than old ones are removed.
Q: What is the difference between remediation and NHI maturity?
A: Remediation is the act of fixing current findings.
Practitioner guidance
- Separate remediation from maturity tracking Keep a risk score for current findings and a zero trust score for architectural progression so leaders do not confuse cleanup with design change.
- Measure static credential growth independently Track new API keys, service accounts, and hardcoded credentials as a separate exposure trend, not as part of the same remediation dashboard.
- Segment scores by owner and identity type Break results out by application owner, service account class, and environment so teams can see where static credential dependence is still being created.
Bottom line: NHI risk scores can improve even when the identity estate is still adding static API keys, service accounts, and hardcoded credentials.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 5 days ago by NHI Mgmt Group
07/06/2026 10:08 pm
Risk scores alone do not prove that an NHI programme is becoming safer. They prove that known findings are being reduced, which is a different outcome. If static credentials continue to proliferate, the organisation can look better on paper while the underlying identity architecture becomes more fragile. Practitioners should treat risk reduction as necessary but insufficient.
A few things that frame the scale:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: When should organisations prioritise zero trust scoring over risk scoring?
A: They should prioritise zero trust scoring when leadership needs to know whether the identity model is becoming structurally safer, not just whether today’s issues are being closed. Risk scoring remains useful for operational response, but zero trust scoring becomes critical when static credential sprawl, governance gaps, or programme reporting make improvement hard to prove.
👉 Read our full editorial: Zero trust scoring for NHI: measuring progress, not just risk
This post was modified 5 days ago by NHI Mgmt Group