Secret Drift

Expanded Definition

secret drift describes a state where a credential keeps working after the business reason for issuing it has changed, expired, or been forgotten. In NHI operations, that means ownership, usage, and revocation no longer move together across the lifecycle of the secret.

Unlike simple secret sprawl, drift is about temporal misalignment. A token may still authenticate even though the workload was replaced, the vendor contract ended, or the automation path was refactored. That makes secret drift a governance failure as much as a technical one. The OWASP Non-Human Identity Top 10 treats this class of issue as part of broader identity and secret management risk, but usage in the industry is still evolving and no single standard governs this term yet.

The most common misapplication is treating an unused credential as safe simply because no alert has fired, which occurs when revocation is not tied to ownership changes, offboarding, or system decommissioning.

Examples and Use Cases

Implementing secret lifecycle governance rigorously often introduces operational overhead, requiring organisations to weigh faster delivery against tighter revocation and review controls.

• A CI pipeline is rebuilt, but the old deployment token is never revoked. The new path works, yet the legacy credential still authenticates in parallel, creating hidden exposure similar to patterns described in the CI/CD pipeline exploitation case study.
• A vendor integration ends after a renewal failure, but the API key remains valid and continues to access internal records. This is a classic drift condition because the business relationship has ended while the secret remains active.
• An engineer rotates a service account password in one environment, but a replica secret in a forgotten staging system is left untouched. The resulting mismatch is easy to miss during change management.
• A leaked token is remediated in a ticketing system, yet the same token is still embedded in a backup script or old agent configuration. The Guide to the Secret Sprawl Challenge is useful here as a reminder that visibility problems often hide drift.
• After an incident, responders find that a credential should have been retired months earlier but was preserved for convenience. That convenience becomes risk when operational dependencies outlive the original approval.

In practice, teams use drift analysis to decide whether a secret is still justified, whether its scope is still appropriate, and whether its rotation or revocation path is actually enforced. The Ultimate Guide to NHIs — Static vs Dynamic Secrets helps frame why static credentials are especially prone to lingering beyond their intended use.

Why It Matters in NHI Security

Secret drift turns identity governance into an accumulation problem: the longer a credential survives after its purpose changes, the more likely it is to become a dormant access path. NHI Mgmt Group research shows that 91.6% of secrets remain valid five days after the targeted organisation is notified, underscoring how slowly remediation can move when revocation is not operationalised.

That lag matters because drift compounds other failures such as excessive privilege, poor inventory, and weak offboarding. A secret that should have been retired may still sit in code, CI/CD tools, or a forgotten vault entry, and it can be abused long after the original owner assumes it is gone. This is why secret drift is closely tied to NHI lifecycle governance and to the broader control expectations described in the OWASP Non-Human Identity Top 10.

It also shows up in real incidents where stale tokens survive normal change windows, as seen in the Salesloft OAuth token breach and the Reviewdog GitHub Action supply chain attack. Organisations typically encounter the cost of secret drift only after a token is reused in an incident, at which point the term becomes operationally unavoidable to address.

Related resources from NHI Mgmt Group

• What is the difference between an identity, a credential, and a secret?
• Why is proactive secret scanning important for NHI security?
• What is the difference between privilege reduction and secret rotation?
• What is the difference between rotating a secret and revoking access?