Credential harvesting is the collection of secrets, tokens, keys, or certificates from a compromised workload. In container environments, it often targets file paths, environment variables, service account tokens, and metadata services because those locations frequently hold reusable identity material.
Expanded Definition
Credential harvesting is the post-compromise collection of reusable identity material from workloads, build systems, and runtime environments. In NHI security, that usually means secrets, tokens, keys, certificates, or metadata-derived access that can be replayed to move laterally or impersonate an identity.
The term is often used alongside secret sprawl, but it is more specific: sprawl describes where secrets are distributed, while harvesting describes how an attacker extracts and concentrates them for reuse. Guidance varies across vendors, but the operational pattern is consistent. Attackers target environment variables, mounted files, container images, CI/CD variables, and instance metadata because these locations often expose machine credentials with broad access. That is why the OWASP Non-Human Identity Top 10 treats secret handling as a core NHI risk, while NIST SP 800-63 Digital Identity Guidelines reinforces the broader principle that identity material must be protected according to its assurance and replay value.
The most common misapplication is treating credential harvesting as a malware problem only, which occurs when teams ignore exposed workload paths and focus solely on endpoint scans.
Examples and Use Cases
Implementing protections against credential harvesting rigorously often introduces operational friction, requiring organisations to weigh deployment speed against tighter secret controls and shorter credential lifetimes.
- A container starts with long-lived API keys injected through environment variables; an attacker who gains shell access reads them and pivots into cloud services.
- A CI/CD job logs a service account token during a failed build; that token is copied from artifacts or log storage and reused before it expires. The CI/CD pipeline exploitation case study shows how quickly pipeline trust can be turned into secret exposure.
- A workload role is accessible from metadata service calls, so a compromised pod requests temporary credentials and uses them to enumerate adjacent systems.
- A developer commits a secrets file into source control, and downstream automation distributes it across environments before anyone revokes it. That pattern is central to the Guide to the Secret Sprawl Challenge.
- An attacker abuses third-party tooling or package hooks to scrape keys from build contexts, a behaviour seen in incidents such as the Reviewdog GitHub Action supply chain attack.
In practice, the same control failures recur across cloud, container, and agentic systems, which is why operators increasingly tie runtime identity protections to Ultimate Guide to NHIs — Static vs Dynamic Secrets and to identity guidance such as the OWASP framework above.
Why It Matters in NHI Security
Credential harvesting turns a single foothold into repeated access because the stolen material often outlives the original compromise. For NHIs, the impact is amplified by automation: one leaked token may authenticate multiple workloads, cross accounts, or provisioned services, especially where RBAC is broad and JIT is absent. The result is not just unauthorized access, but identity collapse, where defenders can no longer trust which workload, agent, or pipeline still holds valid authority.
This risk is visible in sector research. According to The 2024 Non-Human Identity Security Report, 23.7% of organisations share secrets through insecure methods such as email or messaging applications, which increases the chance that harvested credentials are already distributed beyond intended control points. In parallel, the LLMjacking: How Attackers Hijack AI Using Compromised NHIs research shows how exposed AWS credentials are acted on fast, underscoring the need for rapid revocation and narrow scope. In the same governance context, the Guide to the Secret Sprawl Challenge explains why distribution is as dangerous as disclosure.
Organisations typically encounter credential harvesting only after unusual API activity, unexpected cloud spend, or an incident review following lateral movement, at which point the term becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST SP 800-63 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 | Directly addresses secret handling and exposure paths for non-human identities. |
| NIST SP 800-63 | AAL2 | Credential assurance and replay resistance principles inform how machine credentials should be protected. |
| NIST CSF 2.0 | PR.AC-1 | Identity and credential management are central to controlling unauthorized access after harvesting. |
Use assurance-aligned controls and revoke any credential that can be replayed without additional checks.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on May 17, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
