Discovery and hygiene

Expanded Definition

Discovery and hygiene describe two connected disciplines: first, finding every non-human identity, entitlement, secret, and ownership path that exists in production; second, continuously correcting what is stale, excessive, duplicated, or poorly governed. In NHI management, discovery is not a one-time inventory exercise. It is the control that exposes service accounts, API keys, workload identities, certificates, CI/CD tokens, and their privilege relationships across clouds, code, pipelines, and infrastructure. Hygiene is the cleanup layer that removes what should not still exist and tightens what remains.

Definitions vary across vendors on whether secrets, roles, and machine accounts are counted as separate categories or as one governance surface, but the operational requirement is the same: no control can be trusted if the inventory is incomplete. That is why discovery and hygiene sit upstream of rotation, certification, and policy enforcement, and why they align closely with NIST Cybersecurity Framework 2.0 visibility and risk-reduction outcomes. In practice, this work must also map to the full identity lifecycle described in the NHI Lifecycle Management Guide.

The most common misapplication is treating discovery as a quarterly spreadsheet export, which occurs when teams ignore ephemeral identities, orphaned tokens, and embedded secrets outside central vaults.

Examples and Use Cases

Implementing discovery and hygiene rigorously often introduces operational friction, requiring organisations to balance complete visibility against the effort of remediating what the scan reveals.

• Cloud inventory sweeps identify service accounts that were created for a migration project but never removed after go-live, allowing teams to decommission them before they become dormant attack paths.
• Pipeline scanning finds long-term API keys stored in build variables, which are then moved into approved secret storage and paired with rotation and ownership checks.
• Entitlement reviews surface a workload identity that has inherited broad read/write access through a role chain, prompting rightsizing before privilege becomes permanent.
• Certificate discovery detects expired or unmanaged credentials used by internal automation, which prevents silent outages and avoids emergency renewals under pressure.
• Cross-system reconciliation exposes duplicate identities across cloud platforms and on-prem systems, helping teams assign a single owner and eliminate shadow access.

These use cases are central to the Top 10 NHI Issues because most governance gaps begin with missing inventory or uncorrected drift. They also reflect a core NIST outcome: identify assets and understand exposure before control decisions are made, not after.

Why It Matters in NHI Security

Discovery and hygiene are what make NHI governance credible. Without them, organisations cannot accurately enforce least privilege, prove ownership, rotate credentials on time, or confirm that decommissioned identities are truly gone. That creates direct exposure to secrets leakage, privilege sprawl, and hidden persistence. NHIMG research shows that only 5.7% of organisations have full visibility into their service accounts, a signal that most teams are trying to govern identities they cannot fully see. The same research also shows that 97% of NHIs carry excessive privileges, which means weak hygiene is not a minor housekeeping issue but a structural control failure.

Those risks become especially serious in complex environments where identities are embedded in applications, deployment tooling, and third-party integrations. Discovery helps reveal where control boundaries actually exist, while hygiene prevents old access paths from surviving policy changes. This is also where the Ultimate Guide to NHIs — Key Challenges and Risks becomes operationally relevant, because the guide documents how visibility gaps and stale credentials compound across the identity estate. Organisational leaders typically encounter the consequences only after a breach review, at which point discovery and hygiene become operationally unavoidable to address.

Related resources from NHI Mgmt Group

• What is NHI hygiene and why is it the foundation of NHI security?
• Why is NHI discovery and inventory the primary goal of NHI security?
• Why is continuous discovery of AI agents important?
• When does secrets discovery become insufficient on its own?