Topic starter
12/12/2025 11:06 am
TL;DR: A compromised credential was used to access Sumo Logic’s AWS account, prompting credential rotation guidance for API keys, installed collector credentials, hosted-collector secrets, webhook URLs, and user passwords, according to Astrix Security. The case shows how NHI rotation becomes operationally hard when integrations depend on many credential types and downstream platform owners.
Editorial analysis by NHI Mgmt Group, based on content published by Astrix Security: “Sumo Logic: Compromised non-human identity leads to potential supply-chain exploits”.
Key questions
Q: What breaks when a SaaS platform stores many non-human credentials for integrations?
A: Rotation becomes a multi-system recovery task instead of a simple secret reset.
Q: Why do exposed API keys and webhook URLs create such a wide response problem?
A: Because they often authorize more than login.
Q: How can teams tell whether dormant integration credentials are still a risk?
A: If a credential still authenticates, it is still a risk, even when no one thinks it is in use.
Practitioner guidance
- Map every stored credential type Build a live inventory of API keys, installation tokens, hosted-collector credentials, webhook URLs, and user passwords that can affect the platform or its integrations.
- Separate ownership by integration path Assign a named owner for each collector, source, and webhook so revocation and replacement do not depend on ad hoc coordination during an incident.
- Remove inactive credentials proactively Find dormant keys and stale integration secrets that still authenticate successfully, then disable or delete them before an exposure forces emergency cleanup.
Bottom line: This incident shows how one compromised credential can expose an entire integration estate when non-human credentials are stored across collectors, webhooks, and user access paths.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 10 months ago 2 times by Abdelrahman
This topic was modified 6 days ago by NHI Mgmt Group
06/10/2026 4:38 pm
Credential exposure is only the opening condition; integration trust is the real asset. This incident shows that the security boundary is not the single AWS credential that was compromised, but the web of machine identities and secrets built around the platform. When collectors, webhooks, and third-party access all depend on stored credentials, one exposure can force a much wider governance response than many teams plan for. The practitioner lesson is to govern the integration estate as a credential system, not as separate convenience features.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
- Breaches involving third parties rose to 48% of all breaches, a 60% increase on the previous year, according to Verizon's 2026 Data Breach Investigations Report.
A question worth separating out:
Q: Should organisations rotate passwords, keys, and webhook URLs together after a breach?
A: Only when those credentials share the same trust boundary and the same exposure path. The practical rule is to rotate the full set of affected non-human credentials first, then verify each integration separately so a partial reset does not leave hidden access behind.
👉 Read our full editorial: Sumo Logic credential exposure exposes NHI rotation gaps