Stack Audit

Expanded Definition

A stack audit is a structured review of the full operating stack that supports identity, access, automation, and delivery, including tools, dependencies, service accounts, secrets handling, and manual handoffs. In NHI practice, it exposes where controls are duplicated, where ownership is unclear, and where operational resilience depends on undocumented steps rather than governed process.

The term is broader than a software inventory and more specific than a general security assessment. A stack audit examines how identity flows through CI/CD, vaults, orchestration, and integrations, then asks whether each control is necessary, current, and actually enforced. That makes it useful for NHI governance because many failures arise not from a missing policy, but from a control chain that looks complete on paper and breaks in execution. The NIST Cybersecurity Framework 2.0 provides a useful lens for reviewing these dependencies through governance, protect, detect, respond, and recover outcomes, even though it does not name stack audit as a standalone discipline.

Definitions vary across vendors on whether a stack audit includes only technical assets or also process handoffs, approvals, and exception paths. NHI Management Group treats those human and automated seams as part of the audit because they often reveal the highest-risk failure points. The most common misapplication is treating a stack audit as a one-time asset count, which occurs when organisations catalogue tools but do not trace how identities and secrets actually move through them.

Examples and Use Cases

Implementing a stack audit rigorously often introduces short-term documentation and coordination overhead, requiring organisations to weigh operational clarity against the time needed to trace real-world workflows.

• Reviewing a CI/CD pipeline to find hardcoded secrets, duplicated approval checks, and build steps that still rely on manual ticket updates before deployment.
• Mapping service-to-service authentication across applications to identify which API keys, certificates, or tokens are still embedded in legacy scripts rather than managed in a vault.
• Comparing IAM policy, application configuration, and incident response runbooks to locate gaps where a change in one layer is not reflected in the others.
• Tracing onboarding and offboarding of machine identities to see whether revocation, rotation, and ownership updates follow the process described in the NHI Lifecycle Management Guide.
• Using the Ultimate Guide to NHIs — Regulatory and Audit Perspectives alongside NIST Cybersecurity Framework 2.0 to align technical findings with governance expectations.

In practice, stack audits are often triggered by a control failure, a migration, or a post-incident review rather than by routine housekeeping. They are especially valuable when teams suspect that a system is secure only because several people know the workaround.

Why It Matters in NHI Security

Stack audits matter because NHI risk accumulates across tools that were each chosen for a local purpose but were never evaluated as a single control surface. Without this review, organisations can end up with multiple vaults, overlapping rotation logic, stale service accounts, and approval paths that no one can confidently explain. That fragility is especially dangerous in environments where identities outnumber humans and secrets spread across code, pipelines, and configuration layers. NHI Management Group reports that only 5.7% of organisations have full visibility into their service accounts, which makes stack-level visibility a governance necessity rather than a nice-to-have.

A meaningful audit often uncovers issues that map directly to the Top 10 NHI Issues, including excessive privileges, weak rotation, and poor offboarding. It also helps security leaders interpret why Ultimate Guide to NHIs — Key Challenges and Risks emphasizes visibility and governance as core controls. The operational value is not merely detection; it is prioritisation of what must be remediated, retired, or standardised before the next outage or breach. Organisations typically encounter stack audit urgency only after an integration breaks, a secret leaks, or a service account cannot be explained during incident response, at which point the term becomes operationally unavoidable to address.

Related resources from NHI Mgmt Group

• What does good NHI governance look like for audit and compliance purposes?
• Why do non-human identities create more audit risk than human accounts?
• Why do non-human identities create audit risk in modern environments?
• Why do AI agents create more audit risk than traditional service accounts?