NHI governance for CISOs

The question you will be asked

Stolen or exposed credentials and tokens feature in several publicly reported incidents covered on this site, and the details differ. At Okta (2023) it was a service account credential. In the Salesloft Drift incident (2025) it was OAuth tokens for an integration. At Codecov (2021) an altered script sent credentials out of customers' CI environments. In the Snowflake customer incidents (2024) it was customer account credentials stolen by infostealer malware and used on accounts without multi-factor authentication; there is no public evidence that those were service accounts. In our reading, the common thread is a credential with more reach, or a longer life, than it needed.

What follows in a board or regulator conversation is rarely just "are you secure." It is show me. Our advice is to convert a qualitative worry into three quantities you can state without hedging.

Three numbers to hold

1. Inventory coverage. What proportion of your non-human identities are in a maintained inventory with a named owner? Not "we have a tool". What percentage, measured how, verified when.
2. Credentials with unbounded lifetime. How many API keys, service account credentials, and tokens have no expiry? It can often be obtained by querying the systems that issue the credentials.
3. Time from revocation to inability to act. If you revoke a compromised credential right now, how long until it can no longer be used? If you have not measured this, you do not know it, and it is the number an incident will test.

All three are measurable without buying anything. That is deliberate: a CISO who can state them has a defensible position before any procurement decision.

What a defensible position actually looks like

It is not full coverage. Nobody has that. It is:

• A measured baseline with a date on it.
• A risk-ranked remediation order: production-reaching, unbounded-lifetime, unowned credentials first.
• Named accountability per identity class, not per tool.
• An explicit list of what you are not doing yet, and why. This part is easy to omit and, in our view, the part that most protects you. A documented, reasoned deferral is a governance decision. An undocumented gap is a finding.
• A tested revocation path with a recorded result.

Claims to avoid

• "We have full visibility." Hard to demonstrate, and an incident will test it. Say what percentage, measured how.
• "Our PAM covers this." PAM was built around privileged accounts and vaulted credentials. Whether a given product also covers SaaS-to-SaaS OAuth grants, CI/CD tokens, cloud workload identities or agent credentials varies, so ask the vendor to show it. See the company profiles for what each vendor's public documentation describes.
• "We're compliant with the NHI standard." There is no such standard. See the standards tracker.
• "Agents are just service accounts." Defensible for provisioning, indefensible for accountability. An agent acting on a human's behalf creates a delegation chain that a service account model does not represent, and that is what an auditor may ask you to reconstruct.

First ninety days

1. Days 1 to 30: measure the three numbers. Do not procure. Do not restructure. Measure.
2. Days 31 to 60: eliminate the worst class. Unbounded-lifetime credentials reaching production. Assign owners to the top decile by blast radius.
3. Days 61 to 90: run a revocation drill and record the time. Write the deferral list. Take the baseline, the remediation order, and the deferral list to the board together.

Procurement decisions belong after this, not before. Buying a platform without an inventory or an ownership model produces a well-organised list of problems you are not structured to fix.

Frequently asked questions

What should a CISO report to the board about non-human identity?

Three measured numbers rather than a qualitative assurance: inventory coverage as a percentage with a measurement date, the count of credentials with unbounded lifetime, and the measured time from revocation to inability to act. Alongside those, a risk-ranked remediation order and an explicit documented list of what is not being addressed yet and why. A reasoned deferral is a governance decision; an undocumented gap is a finding.

Does our existing PAM solution cover non-human identities?

Partially, in our view. Privileged access management was built around privileged accounts and vaulted credentials, including privileged service accounts. Whether a given product also covers SaaS-to-SaaS OAuth grants, CI/CD pipeline tokens, cloud workload identities or AI agent credentials varies by product, so ask the vendor to show it.

How much of an NHI programme is tooling?

In our view, much of the effort is organisational: attributing an accountable owner to every non-human identity, deciding what each identity class should be permitted to do, and being able to evidence both. A platform does not make those decisions for you, which is why we advise measuring before buying.

Should AI agents be treated differently from service accounts?

For provisioning, they can be treated similarly: both need a distinct, attested, short-lived credential. For accountability they cannot. An agent acting on a human's behalf creates a delegation chain, and if your logs record only the service principal you cannot reconstruct who authorised an action.