NHI Risk Self-Check | Non-Human Identity Software

Machine identity risk is rarely spread evenly across an organization — it tends to concentrate in one or two areas, depending on how credentials are created, tracked, and managed today. These nine questions surface where that concentration is likely to be, and point to specific checks worth running and guide sections worth reading based on the answers. This is a starting point for figuring out where to look first, not a verdict on what to buy.

Question 1 — Third-Party Credential Provisioning

When someone needs to connect an internal application to a third-party service — Stripe, SendGrid, OpenAI, and similar — what's the actual workflow for creating that credential?

Centralized request/approval process; the credential is registered as part of that process. Depends on the team — some go through a process, others create credentials directly when needed. Individual developers generally create these directly, as needed.

Question 2 — Departing-Employee Credential Mapping

If someone who'd created several service accounts, API keys, or webhook integrations left tomorrow, how would you identify everything they created?

Systematic — credentials are tagged or registered with an owner at creation. Possible, but it would take real effort: searching logs, asking around, tribal knowledge. No reliable way to do this.

Question 3 — Orphaned and Idle Service Accounts

How does your organization handle service accounts or API keys that are no longer actively used but still have access?

Identified and reviewed or deprecated on a regular cadence. Identified occasionally, but rarely removed — concern about breaking something keeps them active. No real process for identifying these.

Question 4 — Vault Coverage

Roughly what share of active credentials live in a centralized vault (HashiCorp Vault, AWS Secrets Manager, or similar) versus config files, environment variables, or code?

The large majority — vault use is close to universal. A meaningful share lives outside the vault, for specific known reasons. Most credentials live outside a centralized vault.

Question 5 — Leak Detection Timing

When a credential does end up committed to a repository in plaintext, how is that usually caught?

Pre-commit — hooks or local scanning catch it before it's pushed. Post-push — caught by scanning after the commit lands, but before it reaches production. Reactively, if at all — there's no reliable detection in place.

Question 6 — Rotation Posture

What's the current state of credential rotation for production systems?

Automated rotation covers the large majority of production credentials. Some automation exists, but a lot still runs through manual tickets — and a forced rotation would probably break a few things. Rotation is almost entirely manual, with real uncertainty about what would break if it were enforced.

Question 7 — Trust in Automated Enforcement

If a tool started automatically restricting access for identities it flagged as over-privileged or unused, what would need to be true before your team trusted it in production?

A dry-run/validation period that proves the policy won't break anything before it's enforced. That, plus a fairly long validation window and easy rollback. Automated enforcement feels too risky regardless of safeguards — manual review only, for now.

Question 8 — Agentic AI Visibility

How would you describe visibility into AI agents, MCP implementations, or LLM-based tools (Copilot Studio, LangChain, agent frameworks) accessing systems or data?

Good visibility — what's in use and how it authenticates is well understood. These tools are known to be in use, but not the full picture of how they access credentials or data. Limited visibility — likely an incomplete picture of what's in use at all.

Question 9 — SaaS-to-SaaS OAuth Oversight

When one SaaS platform requests OAuth access to another — a marketing tool requesting access to Microsoft 365 or Salesforce, for example — what oversight exists?

Formal review and approval before access is granted. Some oversight, but inconsistent across teams. Generally, individual users can grant this access without review.

Where Is Your Machine Identity Risk Concentrated?