Should organisations centralise NHI governance instead of using separate scanners and vaults?

Why centralised NHI governance beats separate scanners and vaults

Separate scanners and vaults solve different pieces of the problem, but they do not create a complete governance model. A scanner can tell you what exists, and a vault can store secrets, yet neither one is inherently responsible for deciding who may issue, use, rotate, or revoke an NHI. Central governance matters when the question is control, not just visibility.

That distinction is why lifecycle control belongs in the same decision path as inventory and secrets handling. The NHI Lifecycle Management Guide and Service Account Security Guide both reinforce that provisioning, rotation, offboarding, and least privilege are connected, not separate chores.

When governance is centralised, the organisation can enforce one policy for creation, one policy for access, and one policy for retirement. That is materially different from running disconnected point tools, because the control objective shifts from “find issues” to “close issues with accountable ownership.”

What fragmented scanners and vaults usually miss

Fragmentation creates gaps at the boundaries. A scanner may surface orphaned credentials, but it does not own remediation. A vault may rotate secrets, but it does not necessarily know whether the underlying identity should still exist, whether its permissions are excessive, or whether a human is now using it outside policy. The result is drift: findings without closure, and protection without governance.

That gap is especially visible when multiple teams manage different parts of the same identity estate. One tool may flag exposure, another may store the secret, and a third may approve access, yet no single control layer can answer the basic question, “Is this NHI still legitimate and appropriately privileged?” The Top 10 NHI Issues is useful here because it groups the recurring failure modes around ownership, lifecycle, rotation, and overprivilege.

Centralisation also improves policy consistency. If each vault or scanner implements its own rules, you get different thresholds for expiry, different definitions of inactive, and different remediation workflows. That inconsistency is not just administrative friction, it is a security weakness because the highest-risk identities are often the ones that sit between teams and tools.

How a central NHI control plane should actually work

A central policy layer should sit above discovery and storage, not replace them blindly. It should decide when an identity can be issued, what credentials are acceptable, how long they may live, who can approve exceptions, and when revocation is mandatory. In practice, that means treating scanners as input sources and vaults as enforcement components, while the governance layer owns the policy outcome.

The strongest model is one where ownership, lifecycle, and access decisions are linked. The NHI Ownership and Accountability Guide is relevant because no central governance model works if nobody is accountable for each identity. Likewise, the IAM and IGA Basics guide maps the broader governance pattern: inventory, entitlement control, review, and removal need to connect into one operating model.

Where organisations adopt this pattern well, they usually standardise three decisions: whether the NHI should exist at all, what it is allowed to access, and how it will be retired. That is the governance value of centralisation, it turns scattered security activity into a repeatable control system.

Risk and Threat Considerations

Fragmented NHI controls increase the chance that overprivileged or forgotten identities stay active long after they should have been removed. They also make it easier for stolen secrets to remain useful because discovery, rotation, and revocation are not tightly coordinated.

Failure mechanism: Separate tools create broken handoffs between detection, storage, and remediation, so high-risk identities can remain valid even after they have been identified or rotated in one system.

Impact: The organisation inherits longer exposure windows, weaker accountability, and a larger blast radius if a secret, token, or service credential is misused.

Practitioner Guidance

What to prioritise: Start by defining one authoritative policy layer for issuance, access approval, rotation, and revocation. If a scanner finds an issue but cannot trigger an accountable closure path, it is only partial control.

What to verify: Confirm that every NHI has a named owner, a known lifecycle state, and a documented source of truth for permission changes. If those three cannot be reconciled across tools, central governance is not yet real.

Common mistake: Treating the vault as the governance system. A vault can protect secrets, but it cannot by itself decide whether the underlying identity should still exist or whether its permissions have become unsafe.

Practitioner takeaway: Centralise the decision-making layer, then let scanners and vaults feed it; otherwise, you get visibility without accountability and protection without closure.

Related resources from NHI Mgmt Group

• When should organisations centralise AI governance instead of relying on separate team-level guidelines?
• What breaks when organisations rely on scanners or vaults without full NHI governance?
• What makes agentic AI an NHI governance issue?
• What is the difference between attack surface management and NHI governance?