NHI Engineer Operating Playbook: Daily, Weekly and Quarterly Tasks for Running an NHI Programme

Most non-human identity programmes stall after the first clean-up, because nobody turns the project into a repeatable operating rhythm. Discovery finds thousands of service accounts, keys and tokens, a remediation sprint fixes the worst, and six months later the estate has drifted back. This playbook sets out the recurring work an NHI engineer or small NHI team runs once the programme is live: what to check every day, every week, every month and every quarter, which platform signals feed each task, and how to show the work is paying off. It is written for identity, cloud and platform engineers who own NHI operations, and for the managers who staff them. It assumes the programme already exists; for building it, see the NHI Programme Roadmap, and for the role itself, the NHI and Machine Identity Engineer Career Guide.

Key takeaways

• Cadence beats campaigns. Small daily and weekly checks keep drift low; a yearly clean-up lets risk build for eleven months.
• Daily work is about exposure. Leaked secrets, push protection bypasses, broken discovery collectors and new privileged NHIs need same-day attention.
• Weekly work is about hygiene. Dormant identities, unowned identities, expiring credentials and inventory mismatches are worked as a queue with named owners.
• Quarterly work is about assurance. Ownership attestation, privilege right-sizing and a revocation drill prove that controls work, not just that reports exist.
• Measure the queue, not the activity. Track time to revoke, the share of NHIs with an owner, dormant counts and exception age; ticket counts alone say little.

What steady-state NHI operations covers

The roadmap ends with a stage called continuous governance. This page is what that stage looks like on a calendar. It covers the identities the OWASP Non-Human Identities Top 10 is concerned with: service accounts, cloud roles and access keys, application registrations and service principals, API keys and tokens, CI/CD credentials, certificates, Kubernetes service accounts and AI agent credentials.

The operating model rests on four assets that should already exist from the build phase:

• An inventory: a reconciled list of NHIs with owner, purpose, environment and credential type. See the NHI Inventory Reconciliation.
• A policy: rules for creation, credential lifetime, rotation, privilege and retirement. See the NHI Policy Template.
• An ownership model: every NHI maps to an accountable human or team. See the NHI Ownership Guide.
• A work queue: a ticket queue or board where findings are assigned, with due dates that follow risk.

If one of these is missing, fix that first. Running a cadence against an inventory nobody trusts produces noise and erodes goodwill with the application teams who have to act on findings.

The operating cadence at a glance

The table below is our recommended NHI Mgmt Group baseline for a mid-sized estate. Adjust frequencies to your risk appetite and tooling; the order of priority matters more than the exact interval.

Daily tasks: exposure first

Daily work should take under an hour on a normal day. Its purpose is to catch anything that gives an attacker a usable credential now.

1. Leaked secret triage: work new secret scanning alerts from code hosts, ticketing tools and chat. For each live secret, revoke or rotate first and investigate second; confirm in the provider's logs whether the secret was used after exposure. See the Developer Secret Scanning Triage and the OWASP NHI Top 10 NHI2 Secret Leakage Guide.
2. Push protection bypasses: GitHub records each push protection bypass in the audit log and lists the alerts in the repository, organisation and enterprise security views. A bypass marked "I'll fix it later" creates an open alert; "It's used in tests" and "It's a false positive" close the alert. Review the closed ones too, because a bypass reason is a claim, not a verification. Where many bypasses come from a few repositories, consider delegated bypass, which limits who can bypass and lets designated reviewers approve requests.
3. Collector health: a discovery connector that silently fails makes every downstream report wrong. Alert on failed or empty runs and fix them the same day. See the NHI Discovery Across Cloud, SaaS, CI/CD and On-Premises Environments.
4. New privileged NHIs: review creation of identities with administrative roles, new role assignments to service principals and new long-lived keys on privileged identities. Anything created outside the approved path (request workflow or infrastructure as code) is a finding.
5. Detection hand-offs: pick up SOC alerts that involve NHIs, such as use from a new network or a human signing in as a service account, and supply the context the SOC lacks: owner, purpose and expected behaviour. See the Detection Engineering for Non-Human Identities Guide.

Weekly tasks: hygiene as a queue

Weekly tasks generate work for other teams, so batch them and send one clear request per owner rather than a stream of tickets.

• Dormancy report: pull last-used data and list identities beyond your dormancy window, privileged ones first. Disable before deleting, and give owners a short window to object. See the NHI Dormancy Detection.
• Unowned and orphaned identities: match owners against the HR leaver feed and team changes. An NHI whose owner left is reassigned to the owner's team lead within the week or disabled. See the OWASP NHI Top 10 NHI1 Improper Offboarding Guide.
• Expiring credentials: list certificates and client secrets that expire in the next 30 to 60 days and confirm a rotation is planned. Expiry outages are the fastest way to lose the support of application teams, and preventing them earns credibility for the security asks.
• Reconciliation sample: compare identifiers seen in authentication logs against the inventory and raise any identity that authenticates but is not inventoried.
• Human use of NHIs: review interactive sign-ins by service accounts and shared credentials used from personal devices. See the OWASP NHI Top 10 NHI10 Human Use of NHI Guide.

Monthly and quarterly tasks: assurance

Monthly

• Rotation and lifetime compliance: report credentials older than policy allows, grouped by team. Long-lived secrets are risk NHI7 in the OWASP NHI Top 10; the durable fix is replacing static secrets with federation or short-lived tokens, so track migrations alongside rotations.
• Exception review: every exception has an owner, a reason, compensating controls and an expiry date. Expired exceptions either renew with fresh approval or become findings.
• Third-party and OAuth integrations: review consented SaaS applications, vendor-held credentials and their scopes; remove unused ones and narrow broad scopes. See the OWASP NHI Top 10 NHI3 Vulnerable Third-Party NHI Guide.
• Metrics pack: one page for the sponsor, trends rather than snapshots (see Detection and measurement below).

Quarterly

• Ownership attestation: owners confirm each NHI is still needed and correctly scoped. Unanswered items are disabled after a published grace period. See the NHI Ownership Attestation Campaigns Guide and How to Run an Access Review for Service Accounts.
• Privilege right-sizing: use unused permission analysis to reduce policies on the most privileged identities first. See the OWASP NHI Top 10 NHI5 Overprivileged NHI Guide.
• Revocation drill: pick one credential class (for example a CI/CD deploy key or a cloud access key used by a batch job), revoke and replace it on purpose, and time each step. The drill finds hard-coded copies and undocumented consumers before an incident does.
• Programme review: review the metrics trend, incidents and near misses, and adjust policy and priorities. Re-score maturity yearly against the NHI Governance Maturity Model.

Platform signals that feed the cadence

Most of the cadence runs on data the platforms already expose. The table lists signals described in each provider's documentation, as checked in November 2026; platforms are listed alphabetically and the list is not a ranking. Confirm current values and feature status in the provider's docs before automating against them.

Two coverage notes from the providers' own docs matter for accuracy. The AWS credential report covers the first two access keys per user and does not include service-specific credentials, so pair it with the access key listing APIs. Google Cloud usage metrics do not include Cloud Storage HMAC keys or API keys bound to service accounts, and Cloud Monitoring keeps the metrics for six weeks, so export them if you need a longer dormancy window.

Decision guidance: sizing the rhythm

Detection and measurement

Pick a small set of measures that show the queue shrinking and the response getting faster. We suggest these:

• Median time to revoke a leaked secret: from alert to confirmed revocation, measured on real alerts and on quarterly drills.
• Owner coverage: share of inventoried NHIs with a current, active owner.
• Dormant NHIs beyond window: count and trend, privileged identities reported separately.
• Static credential share: share of NHIs still authenticating with long-lived secrets rather than federation or short-lived tokens.
• Exception age: number of exceptions past expiry, and the oldest open exception.
• Attestation completion: share of NHIs attested on time in the last campaign.

For incident-related measures, see NHI incident metrics.

Framework mapping

Common failure patterns

• Reports without owners: a weekly dormancy list emailed to a distribution list changes nothing. Each finding needs a named owner and a due date.
• Silent collector failure: a broken connector makes the estate look cleaner than it is. Treat an empty run as an incident for the inventory.
• Rotation that breaks production: rotating without knowing consumers causes outages, and the next request is refused. Use the revocation drill to find consumers first; see NHI lifecycle automation.
• Exceptions that never expire: a permanent exception register becomes the real policy. Give every exception an end date.
• Trusting bypass reasons: a push protection bypass marked as a false positive or test secret can still be a live production credential. Sample and verify. See Leaked secret breaches for how exposed secrets have led to wider compromise.
• Campaign thinking: a once-a-year clean-up lets risk build all year. Small regular checks keep the queue manageable.

Practitioner checklist

• Confirm the inventory, policy, ownership model and work queue exist before starting the cadence.
• Publish the cadence table with an owner for every task.
• Set up daily alerts for leaked secrets, push protection bypasses, collector failures and new privileged NHIs.
• Run a weekly dormancy, orphan, expiry and reconciliation report, batched per owner.
• Review rotation compliance, exceptions and third-party integrations monthly.
• Run an ownership attestation campaign and privilege right-sizing every quarter.
• Run one timed revocation drill per quarter and record time to revoke and replace.
• Send a monthly one-page metrics pack showing trends, and re-score maturity yearly.

Standards and references

• OWASP: Non-Human Identities Top 10 (2025)
• NIST: Cybersecurity Framework (CSF) 2.0
• NIST: SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations
• AWS: Generate credential reports for your AWS account
• AWS: IAM Access Analyzer findings
• GitHub: About push protection
• Google Cloud: Monitor usage patterns for service accounts and keys
• Microsoft Learn: Microsoft Entra recommendations overview

Related NHI Mgmt Group resources: NHI Programme Roadmap · NHI and Machine Identity Engineer Career Guide · NHI Dormancy Detection · NHI Governance Maturity Model