Should organisations prioritise workload identity over secret rotation?

Why This Matters for Security Teams

The real decision is not whether rotation is “good” or “bad”; it is whether an organisation can still operate safely while depending on long-lived secrets as a primary control. In dynamic cloud, CI/CD, and service-to-service environments, secret rotation only reduces exposure windows. workload identity changes the model by authenticating the workload itself, which is closer to how modern systems actually run. That distinction matters because machine identity sprawl is already larger than many teams can see: SailPoint reports that 69% of organisations now have more machine identities than human ones in its Critical Gaps in Machine Identity Management report.

Current guidance from the OWASP Non-Human Identity Top 10 and NHIMG’s Guide to the Secret Sprawl Challenge points to the same operational reality: the more places a secret lives, the more places it can leak, linger, or be misused. In practice, many security teams encounter secret failure only after a deployment outage or compromise has already occurred, rather than through intentional lifecycle control.

How It Works in Practice

The strongest pattern is to treat secret rotation as a compensating control, not the end state. Workload identity reduces the number of static credentials that must be issued, copied, stored, and rotated. For implementation, that usually means cryptographic workload authentication through mechanisms such as SPIFFE IDs, short-lived tokens, or identity federation, with policy evaluated at request time rather than hard-coded into static allowlists. The SPIFFE workload identity specification is useful here because it defines identity for the workload itself, not just for the secret it presents.

Rotation still has a role where external systems require credentials, certificates, or API keys. But if a service can exchange workload identity for an ephemeral credential at runtime, the stored secret becomes shorter lived or disappears altogether. That is why NHIMG’s Ultimate Guide to NHIs — Static vs Dynamic Secrets and Guide to NHI Rotation Challenges both frame rotation as only one layer in a wider lifecycle problem. A mature design usually includes:

• Workload identity as the default authentication primitive for services, jobs, and agents.
• Just-in-time, ephemeral secrets only where integration constraints still require them.
• Policy-as-code for intent-based authorisation, so access is checked at runtime.
• Automated lifecycle ownership, because manual tracking does not scale.

This approach aligns with the security direction in the OWASP Non-Human Identity Top 10 and NHIMG’s NHI Lifecycle Management Guide. These controls tend to break down when legacy systems require shared credentials, because the identity boundary remains tied to a secret rather than the workload.

Common Variations and Edge Cases

Tighter workload identity often increases integration effort, so organisations have to balance architectural benefit against platform maturity and legacy constraints. There is no universal standard for every environment yet, especially where mainframes, third-party SaaS connectors, or embedded devices cannot accept federated workload credentials.

In those cases, secret rotation remains necessary, but it should be targeted. Use it for unavoidable credentials, shorten TTLs where possible, and move the highest-risk services first. NHIMG’s Ultimate Guide to NHIs — Lifecycle Processes for Managing NHIs is the better lens for deciding where each control belongs across discovery, issuance, rotation, and revocation. The practical rule is simple: if a workload can prove what it is, then rotation becomes a backstop, not the core trust model.

This is especially important in environments with hybrid cloud, high deployment frequency, or autonomous tools that chain multiple API calls. NHIMG’s Top 10 NHI Issues shows that visibility and ownership are still common weak points, so the safest path is to reduce secret dependence wherever workloads can authenticate dynamically.

Related resources from NHI Mgmt Group

• When should organisations prioritise entitlement reduction over secret rotation?
• When should organisations prioritise workload identity controls over more user-focused IAM work?
• When should organisations prioritise Zero Standing Privilege for non-human identities?
• What is the difference between privilege reduction and secret rotation?