Tools
Seven free tools covering the decisions that come up before, during, and after evaluating NHI security software. Every calculation runs client-side — nothing leaves your browser to use a tool. Exporting results as a PDF requires a free subscription.
Risk Self-Check
Nine questions about how credentials are created, tracked, and managed today — the answers surface where machine identity risk is most likely concentrated, and point to specific checks worth running and guide sections worth reading next. A starting point for figuring out where to look first, not a verdict on what to buy.
NHI-to-Human Ratio Calculator
Estimate your own NHI-to-human identity ratio from a handful of environment counts — applications, cloud accounts, CI/CD pipelines, SaaS integrations — instead of citing someone else's industry-wide figure. Outputs a breakdown by source you can bring into a budget conversation.
Credential Rotation Debt Calculator
Turn your credential rotation cadence into a single cumulative exposure figure, broken down by bucket — never rotated, annual, quarterly, automated — with a what-if comparison showing what moving credentials to automated rotation would actually buy you.
Privilege Waste Calculator
Turn your environment's scale and your access-analyzer's unused-permissions percentage into an actual count of dormant permissions — including how many are high-risk action types — plus a what-if for how much your next review cycle would clear.
OAuth Scope Decoder
Decode the OAuth scopes a connected app was granted on Microsoft 365, Google Workspace, or Salesforce into plain English, with a risk read for the combination — including what offline access changes about how long that access actually persists.
Vendor Comparison
Compare NHI security vendors side by side across governance, secrets management, machine identity/PKI, workload identity, CIEM, and identity platform categories — filterable by the criteria that matter for your evaluation, not a generic feature checklist.
Orphaned Identity Routing Simulator
Simulate shadow logging vs. hard block routing for an orphaned identity's traffic, and watch the effect on security visibility, pipeline stability, and your audit trail update in real time. Built around the Conditional Deny pattern from Phase 4 of the NHI rollout guide — useful for walking a team through why a staged approach beats an immediate revocation.
All calculations are client-side — no data leaves your browser to use any of these. Each tool's results can be exported as a PDF for free with an email, useful for sharing a breakdown internally or dropping into a procurement or audit record. None of these tools require a paid subscription to use; the paid edition covers additional depth, not basic functionality.