Most organisations know they have a non-human identity problem; far fewer can say how mature their NHI governance actually is, or what to do next. Service accounts, API keys, tokens, certificates, workload identities and now AI agents outnumber people in almost every environment, and they are created by developers, pipelines and SaaS integrations far faster than any central team can track. This five-level NHI Governance Maturity Model, developed by NHI Mgmt Group, describes how NHI governance progresses from Ad hoc to Optimised across eight dimensions. Use it to assess where you are, agree a realistic target and build a roadmap that reduces risk at each step.
Key takeaways
- The five levels are Ad hoc, Developing, Defined, Managed and Optimised.
- Maturity is assessed across eight dimensions: inventory and discovery, ownership, credential management, access and privilege, lifecycle, monitoring and response, AI agents, and governance and metrics.
- Most organisations start at Level 1 or 2. Level 3 (Defined) is a sensible first target: known, owned NHIs with defined processes.
- Progress is uneven. Score each dimension separately and fix the weakest high-risk dimension first.
- Maturity should show up in measurable outcomes: fewer long-lived secrets, fewer orphaned NHIs, faster revocation.
The five levels
| Level | Name | What it looks like |
|---|---|---|
| 1 | Ad hoc | NHIs are created by whoever needs them, with no inventory, no owners and secrets scattered across code, config and chat. Problems are found through incidents. |
| 2 | Developing | The problem is recognised. Some discovery and secrets scanning is in place, a vault exists for part of the estate, and a few high-risk NHIs have owners. Coverage is patchy and manual. |
| 3 | Defined | Policy and standards exist for creating, owning, storing, rotating and retiring NHIs. There is an inventory across the main platforms, every NHI in scope has an owner, and new NHIs follow a defined process. |
| 4 | Managed | Processes are automated and measured. Short-lived and federated credentials are the default, least privilege is enforced and reviewed, NHI behaviour is monitored, and metrics drive decisions. |
| 5 | Optimised | NHI governance is continuous and largely secretless. Credentials are ephemeral, access is granted just in time and per task, anomalies trigger automated response, and AI agents are governed as first-class identities. |
The eight dimensions
| Dimension | Level 1 Ad hoc | Level 3 Defined | Level 5 Optimised |
|---|---|---|---|
| Inventory and discovery | No inventory | Inventory across main clouds, directories, SaaS and code, refreshed regularly | Continuous discovery across all sources, including shadow AI and third-party NHIs |
| Ownership and accountability | No owners | Every in-scope NHI has a named human owner and a purpose | Ownership assigned at creation and transferred automatically with team changes |
| Credential management | Secrets in code and config | Secrets vaulted, scanning in place, rotation defined | Secretless by default: federation, workload identity and ephemeral credentials |
| Access and privilege | Broad, standing permissions | Least privilege standards; privileged NHIs identified and restricted | Just-in-time, task-scoped access with continuous right-sizing |
| Lifecycle | NHIs never retired | Defined create, rotate and decommission process; stale NHIs removed | Lifecycle fully automated and tied to workload and application lifecycle |
| Monitoring and response | No NHI-specific monitoring | NHI activity logged; leak response playbook in place | Behavioural baselines with automated containment and revocation |
| AI agents | Agents use shared keys or borrowed user credentials | Agents registered, owned and given their own identities | Agents receive delegated, per-task access with human approval for high-impact actions |
| Governance and metrics | No policy or reporting | NHI policy approved; basic metrics reported | Risk-based metrics drive investment and are reported to the board |
Self-assessment questions
For each dimension, score the level that best describes you today. Be honest: a control that exists on paper but covers a fraction of the estate is Level 2, not Level 3.
- Inventory: could you list every service account, API key and OAuth app with access to your most critical system within a day?
- Ownership: what share of your NHIs has a named, current owner?
- Credentials: how many long-lived static secrets are in use, and how many are older than a year?
- Access: how many NHIs hold administrator or owner-level rights, and when were they last reviewed?
- Lifecycle: what happens to an NHI when the application or its owner goes away?
- Monitoring: would you notice a service account being used from a new location, or a leaked key being used?
- AI agents: do you know which agents exist, whom they act for and what they can access?
- Governance: is there an approved NHI policy, and who is accountable for it?
Moving up a level
From Ad hoc to Developing
- Run discovery on your main cloud, directory and code platforms. See the NHI Lifecycle Management Guide.
- Turn on secrets scanning and push protection in source control.
- Stand up a vault and move the highest-risk secrets into it. See the Secrets Management Guide.
- Assign owners to the most privileged NHIs first.
From Developing to Defined
- Publish an NHI policy covering creation, ownership, storage, rotation, access and retirement.
- Extend inventory to SaaS integrations and OAuth apps. See the SaaS and OAuth App Governance Guide.
- Require an owner and purpose for every new NHI, and assign owners to existing ones. See the NHI Ownership Guide.
- Adopt a leak response playbook. See the Leaked Credential Response Playbook.
- Include NHIs in access reviews. See the Access Reviews Guide.
From Defined to Managed
- Replace static secrets with workload identity federation and short-lived credentials. See the NHI Authentication Guide.
- Automate rotation where static secrets remain. See the Guide to NHI Rotation Challenges.
- Right-size permissions using activity data. See the Cloud PAM and CIEM Guide.
- Monitor NHI behaviour and alert on anomalies. See the ITDR Guide.
- Register AI agents and give them their own identities. See the Agentic AI Identity Guide.
From Managed to Optimised
- Make secretless patterns the default for new workloads.
- Grant NHI and agent privileges just in time and per task. See the JIT Access Guide.
- Automate containment: revoke or quarantine credentials automatically on high-confidence detections.
- Report risk-based NHI metrics to leadership. See the Identity Security Metrics Guide.
Metrics that show maturity
- Percentage of NHIs with a named owner.
- Number and age of long-lived static secrets.
- Percentage of workloads using federated or short-lived credentials.
- Number of NHIs with privileged access, and time since last review.
- Stale and orphaned NHIs found and removed.
- Mean time to revoke a leaked credential.
- Percentage of AI agents registered with an owner and scoped access.
How this model relates to others
The NHI Governance Maturity Model focuses on non-human identities. The Identity Security Maturity Model covers all identity types across eight capabilities, and the Agentic AI Identity Maturity Model goes deeper on AI agents. Use them together: an organisation's NHI maturity usually lags its workforce identity maturity, and agent maturity usually lags both.
Practitioner checklist
- Score each of the eight dimensions separately, using evidence rather than policy statements.
- Set Level 3 as the first target, with Level 4 for the highest-risk systems.
- Prioritise the lowest-scoring dimension that affects your most critical assets.
- Agree metrics for each dimension and baseline them now.
- Reassess at least annually and after major platform changes.
- Include AI agents from the start rather than treating them as a separate programme.
Standards and references
- OWASP Non-Human Identities Top 10 (2025)
- NIST Cybersecurity Framework 2.0
- NIST SP 800-53 Rev. 5 (IA-2, IA-5, AC-2, AC-6)
- CISA Zero Trust Maturity Model, version 2.0
Related NHI Mgmt Group resources: Ultimate Guide to NHIs · Top 10 NHI Issues · NHI Lifecycle Management Guide · NHI Security Platform Buyer's Guide
