An indicator of exposure is a directory or identity condition that creates attacker opportunity before an incident occurs. In practice, it is a misconfiguration, stale account state, or risky setting that can be abused for persistence, privilege change, or recovery failure if left unresolved.
Expanded Definition
An indicator of exposure is not the incident itself, but the condition that makes later abuse likely. In NHI security, that usually means a stale service account, an overbroad role, an expired secret that still validates, or a recovery path that can be redirected by an attacker. The term is used to prioritise remediation before compromise, which makes it closely related to attack surface management, identity hygiene, and privilege reduction.
Definitions vary across vendors, because some teams treat exposure as any observable weakness while others reserve it for identity states that are directly exploitable. NHI Management Group treats it as a pre-incident identity or directory condition that creates attacker opportunity. That framing is especially important for service accounts, API keys, certificates, and machine identities that often persist long after the business process that created them has changed. For context on why these conditions matter, see Ultimate Guide to NHIs — Why NHI Security Matters Now and the identity abuse patterns described in CISA Identity and Access Management.
The most common misapplication is treating the indicator as a generic vulnerability label, which occurs when teams fail to connect the condition to a specific identity path that an attacker can use.
Examples and Use Cases
Implementing indicator-of-exposure detection rigorously often introduces triage noise, requiring organisations to weigh faster remediation against the operational cost of investigating every risky identity state.
- A service account has not been used in 180 days but still holds privileges to production storage and secrets, creating a dormant path for persistence.
- An API key remains valid after an application owner rotates the primary credential, leaving a backup token exposed in code or CI/CD logs; this aligns with the secret sprawl patterns discussed in the Guide to the Secret Sprawl Challenge.
- A recovery email or reset workflow is tied to a compromised mailbox, turning account recovery into an attacker-controlled entry point.
- A workload identity inherits excessive permissions after a project migration, so the exposure is not the workload itself but the lingering access path.
- Analysts use identity telemetry and exposure scoring to surface accounts that resemble the preconditions seen in public breach cases, including the patterns covered in 52 NHI Breaches Analysis.
For implementation guidance on identity risk context, practitioners often compare these signals with CISA ICAM guidance and the identity lifecycle controls in the Ultimate Guide to NHIs.
Why It Matters in NHI Security
Indicators of exposure matter because NHIs tend to accumulate risk silently. NHI Management Group reports that only 5.7% of organisations have full visibility into their service accounts, and 97% of NHIs carry excessive privileges, which means exposure often persists long enough to become an attacker foothold rather than a minor hygiene issue. When a stale identity, misconfigured vault, or unreclaimed secret is left in place, the exposure can enable privilege escalation, lateral movement, or recovery abuse long before defenders notice active exploitation.
This is why exposure management belongs in governance, not just incident response. The most useful signals are those tied to identity ownership, rotation status, and offboarding completeness, because they reveal where attacker opportunity already exists. The NHI context is especially sensitive during external access, automation changes, and mergers, when orphaned identities and inherited permissions are most likely to survive. NHI Management Group’s research on the Ultimate Guide to NHIs shows how weak visibility and poor rotation practices compound one another, while the Anthropic report on AI-orchestrated cyber espionage underscores how quickly exposed identities can be operationalised by advanced actors. Organisations typically encounter this consequence only after a breach review or access incident, at which point indicator of exposure becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST Zero Trust (SP 800-207), NIST SP 800-63 and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 | Covers improper secret and credential management that often creates exposure conditions. |
| NIST CSF 2.0 | PR.AC | Identity access controls directly govern which exposure conditions can be abused. |
| NIST Zero Trust (SP 800-207) | 0 | Zero trust assumes exposure can exist and must be continuously verified. |
| NIST SP 800-63 | Identity assurance principles inform how credentials and recovery states are evaluated. | |
| NIST AI RMF | Risk framing helps prioritise pre-incident identity exposure before misuse occurs. |
Inventory exposed identities and remediate stale secrets, overprivilege, and weak offboarding paths.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on July 9, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
