How should security teams respond if attacker-controlled formulas were compiled already?

Why This Matters for Security Teams

If attacker-controlled formulas were compiled already, the issue is no longer limited to a bad input field. The host has effectively executed attacker-influenced logic inside an application process, which means the response should shift from “sanitize and retry” to “treat as application-layer compromise.” Security teams need to assume the process may have accessed local data, runtime secrets, and downstream services, then verify whether that execution crossed trust boundaries.

This is why NHI and runtime-secrets discipline matter in the first place. The State of Non-Human Identity Security notes that lack of credential rotation is cited as the top cause of NHI-related attacks by 45% of organisations, with inadequate monitoring and logging and over-privileged accounts close behind. Once a compiled formula can reach a token, API key, or service account, the blast radius often extends far beyond the original worksheet or parser. Current guidance also aligns with the broader attack-path view in the MITRE ATT&CK Enterprise Matrix, where execution is only the beginning of persistence, discovery, and exfiltration.

In practice, many security teams encounter formula abuse only after outbound traffic, secret access, or data tampering has already occurred, rather than through intentional detection.

How It Works in Practice

The right response is to treat the affected service as if attacker code ran inside it, then scope the compromise from the process outward. Start by isolating the workload, capturing memory and process telemetry if available, and preserving the original formula content, compilation artifacts, and surrounding request logs. Then review whether the process could reach cloud metadata, vault endpoints, local config files, or service-to-service credentials. That framing matters because a compiled formula is not just malformed data anymore, it is executable logic with the potential to chain additional actions.

Practically, teams should look for four things at once:

• formula changes, suspicious delimiters, and payloads that reference external resources or shell-like behaviour
• outbound connections from the service to unfamiliar domains, IPs, or internal hosts
• use of reachable secrets, including OAuth tokens, API keys, certificates, and cached session material
• any privilege escalation or lateral movement enabled by the host identity

Rotation should focus on what the process could actually touch, not just what appears in the spreadsheet layer. If the service used a workload identity or temporary token, revoke and reissue it, then confirm that the new token scope is narrower than the old one. That is consistent with NHI response guidance in the The 52 NHI Breaches Report, where weak containment and insufficient credential hygiene repeatedly amplify the impact of otherwise small exposures. For broader incident handling, CISA cyber threat advisories remain a useful reference point for triage, logging, and containment sequencing.

Re-enable execution only after the dangerous API path is removed, the parser is isolated, or the formula engine is disabled for the affected workflow. These controls tend to break down in file-processing pipelines that reuse privileged service accounts across many jobs because the same identity can still reach unrelated systems after the initial formula is blocked.

Common Variations and Edge Cases

Tighter containment often increases operational friction, requiring organisations to balance faster recovery against the risk of reintroducing the same execution path too early. There is no universal standard for every spreadsheet, ETL, or document-rendering stack, so the depth of investigation should match the privilege level and connectivity of the service. A low-risk reporting job is not handled the same way as a multi-tenant automation service with direct access to secrets and outbound network reach.

One common edge case is when the formula was compiled but never visibly executed by a user. That does not eliminate risk if the backend renderer, preview service, or indexing pipeline evaluated it server-side. Another is when the affected host uses cached credentials rather than explicit secret stores, because rotating the obvious secret may not invalidate the live session. Best practice is evolving here, but current guidance suggests treating any compiled attacker-controlled formula in a privileged runtime as an execution event until proven otherwise.

For teams formalising policy, the OWASP NHI Top 10 is useful for thinking about runtime misuse, while the Anthropic report on AI-orchestrated cyber espionage is a reminder that automated systems can convert one foothold into many actions very quickly. In this context, the safest posture is to assume the compiled formula may have been a delivery mechanism for broader application-layer compromise, not an isolated spreadsheet defect.

Related resources from NHI Mgmt Group

• How do security teams know whether a patched appliance was already compromised?
• Why are NHIs a critical concern for security teams?
• What steps should security teams take to prevent Shadow AI risks?
• Why is the abuse of NHIs a priority for security teams?