Topic starter
23/03/2026 2:16 pm
TL;DR: OAuth applications now rival or exceed human users in privilege while surviving MFA, password resets, and off-boarding, according to Cyera Research. That makes unmanaged OAuth access a durable NHI governance problem, not just an integration issue.
Editorial analysis by NHI Mgmt Group, based on content published by Cyera: “The Stealthy Rise of OAuth Application Risk: Why Non-Human Identities are the New Security Frontier”.
Key questions
Q: What breaks when OAuth access is not governed like a non-human identity?
A: Access persists beyond the user session that created it, so the organisation loses the usual sign-in checkpoints that would normally bound use.
Q: Why are OAuth tokens risky even when MFA is enforced for users?
A: MFA protects the user login, but OAuth tokens can keep working after the initial approval without repeated user authentication.
Q: How do security teams know if OAuth sessions are being abused?
A: Look for repeated token redemptions, unfamiliar geolocation, device changes, and abnormal application access immediately after a successful login.
Practitioner guidance
- Inventory OAuth applications as identities Build a complete register of OAuth apps, their owners, scopes, publishers, and last review dates so they are governed like other non-human identities.
- Map application consent to business ownership Require every application to have a named business owner and a security owner before consent is approved or renewed.
- Revoke tokens on lifecycle changes Trigger application token review and revocation when users move role, leave the organisation, or when an integration is no longer required.
Bottom line: OAuth applications can persist as governed identities long after the human user relationship changes, which makes them an NHI governance issue.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
08/10/2026 5:29 pm
OAuth access has become an NHI governance problem because consented application access outlives the human lifecycle. Password resets, MFA enforcement, and employee off-boarding do not automatically revoke application tokens. That means the identity being governed is not the user alone, but the delegated application identity that continues to act after the user relationship ends. The practitioner implication is that lifecycle control must follow the app, not just the account.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Who should own OAuth application governance in an enterprise?
A: Ownership should be shared, but accountable. The business owner needs to justify the integration, security needs to classify the risk, and data governance needs to understand what information the app can reach. Without named ownership, revocation decisions become slow and contested.
👉 Read our full editorial: OAuth application risk is becoming an NHI governance problem