Secrets management and ATT&CK mapping: what IAM teams should fix

TL;DR: Rising machine identities, now at 45 for every human identity, will more than double in 18 months, making secrets management central to defending against credential-based attack paths across the MITRE ATT&CK lifecycle, according to Akeyless. The practical issue is not just rotation, but whether NHI governance, RBAC, JIT, and dynamic secrets can shrink standing privilege before attackers exploit exposed credentials.

NHIMG editorial — based on content published by Akeyless: Secrets management and MITRE ATT&CK in the context of growing machine identities

By the numbers:

• For every human identity, there are 45 machine identities, and that ratio will more than double in the next 18 months.
• 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, sharing sensitive data, and revealing credentials.
• When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases.

Questions worth separating out

Q: What breaks when machine identities rely on bearer secrets?

A: Bearer secrets can be replayed once exposed, so possession of the token becomes enough to act.

Q: Why do service accounts with standing privilege increase lateral movement risk?

A: Standing privilege expands the blast radius of one compromised identity.

Q: How do security teams know whether secret rotation is actually working?

A: Rotation is working only if exposed credentials are found quickly, revoked everywhere they are used and replaced before attackers can reuse them.

Practitioner guidance

• Classify every secret as an identity asset Map service accounts, API keys, tokens, and certificates into the same governance inventory used for human access.
• Reduce standing privilege on all machine accounts Review workload roles for persistent permissions that outlive the task they support.
• Shorten the exposure window for exposed credentials Automate rotation for secrets with any external or shared exposure path, especially those in CI/CD, code repositories, and cloud configuration.

What's in the full article

Akeyless's full blog covers the operational detail this post intentionally leaves for the source:

• The article’s ATT&CK mapping examples for initial access, privilege escalation, and exfiltration.
• The product-specific explanation of dynamic secrets, RBAC, JIT access, and secretless architecture.
• The white paper download referenced in the post, which goes deeper into the implementation narrative.
• The vendor’s demo path for teams that want to inspect the platform workflow directly.

👉 Read Akeyless's analysis of secrets management and MITRE ATT&CK mapping →

Secrets management and ATT&CK mapping: what IAM teams should fix?

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →