Notifications
Clear all
Topic starter
14/09/2026 10:10 am
TL;DR: Credentials now create reusable attack paths across humans, AI agents, and other non-human identities, and patching alone does not remove the risk because copied keys stay valid until revoked, according to GitGuardian. The governance problem is not exposure alone but the inability to discover, validate, and retire secrets fast enough across repositories, assistants, and NHI estates.
NHIMG editorial — based on content published by GitGuardian: The Business Case for Secrets Security Credentials turn access into attack paths
By the numbers:
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases.
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, with 46% confirmed and 26% suspected.
Questions worth separating out
Q: What breaks when exposed credentials are not revoked quickly?
A: Exposed credentials create a standing access window that attackers can exploit before defenders notice.
Q: Why do exposed service account credentials create such broad risk?
A: Service account credentials often carry standing access into cloud, CI/CD, or SaaS systems, so one exposed secret can open multiple control paths at once.
Q: What do teams get wrong about secrets scanning at scale?
A: They treat scanning as the control instead of one input to lifecycle governance.
Practitioner guidance
- Inventory all secret-bearing identities Create a single inventory for API keys, tokens, certificates, service accounts, and AI-assisted code credentials, then assign an owner and revocation path to each one.
- Track exposure to revocation time Measure how long exposed secrets remain valid after discovery, and treat that interval as a board-reportable risk indicator for NHI governance.
- Extend scanning beyond source code Include public repositories, internal repositories, developer workstations, and AI coding assistants in secret discovery so exposed values do not stay hidden in adjacent workflows.
What's in the full article
GitGuardian's full white paper covers the operational detail this post intentionally leaves for the source:
- Board-ready framing for why credential exposure remains a live security problem after patching
- A two-page explanation of how valid account abuse changes the cost profile of a breach
- The article's own discussion of exposure across public GitHub, internal repositories, and AI coding assistants
- The investment case for improving remediation speed and finding volume across secrets security workflows
👉 Read GitGuardian's briefing on why patching alone will not solve credential exposure →
Credential exposure and NHI sprawl: what boards need to know?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
14/09/2026 10:11 am
Credentials are now the attack path, not just the payload. A patch can close the original flaw, but it cannot make a copied key stop working. That breaks the old assumption that remediation and exposure are the same problem. In NHI governance terms, the issue is valid account abuse by a credential that persists beyond the vulnerability that exposed it, which is why lifecycle control matters as much as detection.
A few things that frame the scale:
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, with 46% confirmed and 26% suspected, according to The 2024 ESG Report: Managing Non-Human Identities.
- Enterprises that have experienced a compromised NHI averaged 2.7 separate incidents in the past 12 months, according to The 2024 ESG Report: Managing Non-Human Identities.
A question worth separating out:
Q: How should organisations budget for secrets security?
A: They should budget against reduced exposure time, lower revocation effort, and fewer high-reach credentials left in circulation. The business case is strongest when secrets security is treated as a control for valid account abuse, not as a narrow developer hygiene project. That framing makes the investment measurable in risk reduction and response speed.
👉 Read our full editorial: Credentials as attack paths: why patching alone is not enough
