Topic starter
12/12/2025 11:29 am
TL;DR: Non-human access through OAuth apps, service accounts, tokens, and marketplace integrations creates a supply chain attack surface that traditional IAM and TPRM processes struggle to see or govern, according to Astrix Security. The governance gap is now operational, not theoretical, because compromised third-party access can reach production systems before security teams even know the app exists.
Editorial analysis by NHI Mgmt Group, based on content published by Astrix Security: “Part 3: The anatomy of supply chain attacks: Non-human identities & TPRM failure”.
By the numbers:
- Astrix Security reports that 1 in every 10 OAuth apps connected to Google Workspace are connected with a highly-privileged, administrative account.
- Astrix Security notes that current detection and containment timelines can leave attackers moving inside an environment for 204 days before identification and 73 days more before containment.
Key questions
Q: What fails when third-party non-human access is approved like normal vendor software?
A: The failure is that the approval is treated as a one-time procurement decision instead of a governed access lifecycle.
Q: Why does third-party NHI access create more risk than a standard vendor questionnaire suggests?
A: Because questionnaires describe the vendor, not the live permissions inside your environment.
Q: What are the signs that NHI governance is failing in an enterprise?
A: Common warning signs include unclear ownership for service accounts, secrets stored in code or configuration instead of managed vaults, infrequent rotation, and weak offboarding of API keys.
Practitioner guidance
- Map third-party NHI consent paths Build an inventory of OAuth apps, marketplace integrations, service accounts and tokens that can reach production systems, then assign an internal owner for each one.
- Review administrative NHI privileges Identify non-human credentials with administrative scope and verify whether they actually need write access, tenant-wide permissions or access to source code and collaboration tools.
- Replace snapshot vendor reviews with live monitoring Track permission changes, new app installs and scope expansions continuously so risky third-party access is visible before an incident forces discovery.
Bottom line: NHI supply chain exposure is driven by third-party apps, tokens and service accounts that can reach production faster than IAM and TPRM controls can track.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 10 months ago 2 times by Abdelrahman
This topic was modified 6 days ago by NHI Mgmt Group
06/10/2026 4:38 pm
Third-party NHI exposure is now a supply chain control problem, not a niche integration issue. The article shows that OAuth apps, service accounts and marketplace tools can enter production with very little governance, then remain active outside the visibility of the teams expected to own them. That shifts the problem from user IAM into lifecycle governance for external machine access. The practitioner implication is that NHI inventory and ownership must extend beyond internal systems to every supplier-managed access path.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
- 59% of compromised machines in a major 2025 supply chain attack were CI/CD runners rather than personal workstations, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: Who should own non-human identity risk in an enterprise?
A: Non-human identity risk should be owned jointly by IAM, PAM, cloud, and platform teams, with clear accountability for inventory, entitlement scope, rotation, and retirement. If ownership sits only with operations or only with security, NHIs tend to stay embedded in workflows without lifecycle control or auditable decision-making.
👉 Read our full editorial: NHI supply chain risk is outpacing traditional IAM controls