OWASP NHI Top 10 Explained

Identities that outlive the people, projects and vendors that created them. When an engineer leaves or a contract ends, the human access is removed and the machine access is forgotten — and it keeps working.

Question

Which identities were created or are used by people who are no longer here, or for projects that have ended?

Evidence

Ownership records joined to HR and directory leaver events; identities whose attested owner is inactive; last authentication per identity.

Control

An owner with an end date for every identity; offboarding that triggers re-attestation of everything the leaver owned; a decommission workflow with a rollback window.

Trustivan today

Ownership from provider tags or assigned by a person, and lifecycle states, are available. No identity provider or directory connector exists, so leaver events are not correlated.

Credentials copied to places they should never be: repositories, CI logs, chat, wikis, tickets, container images, laptops. A leak is dangerous in proportion to what the credential unlocks — which a scanner alone cannot tell you.

Question

Where do live copies of each credential exist, and which identity — with what reach — does each one authenticate?

Evidence

Scan results across code, CI/CD, collaboration tools and storage, mapped to the credential’s identity, owner and blast radius.

Control

Map every discovered secret to an identity before acting; rotate with the owner informed; shorten lifetimes so that a leak expires on its own.

Trustivan today

Credentials are mapped to identities, and exposure findings are raised from exposures reported through the ingestion API. Trustivan ships no scanner and never reads secret values.

Vendor integrations, SaaS connectors and OAuth apps that hold standing access inside your environment. A vulnerability or breach at the vendor becomes access to you, through an identity you granted and rarely review.

Question

Which third-party identities can act inside our environment, with what scopes, granted by whom, and when were they last used?

Evidence

OAuth grants and connected apps with scopes, consenting user, installation date and last activity; the resources each grant reaches.

Control

Inventory and an owner for every integration identity; least-scope consent; periodic re-consent; revocation on inactivity.

Trustivan today

GitHub App installations and bot accounts are discovered and attributed to owners today. SaaS OAuth apps and app registrations are not read by any connector yet, and vendor vulnerability intelligence is out of scope.

Machines authenticating with methods you would never accept from a person: static keys, shared passwords, unsigned tokens, deprecated flows. The identity is real; the proof of identity is weak.

Question

How does each identity prove who it is, and could that proof be replaced with federation or short-lived, attested credentials?

Evidence

Per-identity credential type — static key, client secret, certificate, workload identity federation — and the authentication flows the source reports.

Control

Prefer workload identity federation and short-lived tokens; retire static keys where the platform supports it; make authentication method a classification attribute.

Trustivan today

Credential type and age are recorded where connectors expose them, with rotation-overdue and expiry findings. Replacing a static key happens at the provider, not in Trustivan.

The gap between what an identity can do and what it needs to do. Broad roles are granted to get something working and never narrowed, so the blast radius of every other failure grows.

Question

What does this identity actually do, compared with what it could do?

Evidence

Effective permission evaluation across roles, policies and trust relationships, compared with observed actions over a window.

Control

Scope to observed use with the owner’s confirmation; remove dormant privileges; treat unused administrative rights as findings.

Trustivan today

Effective access is available as an upper bound, and so is ownership, the precondition for safe scoping. Comparing access with observed use is a future capability: no connector collects permission usage.

Pipelines and workloads obtaining identity in fragile ways: long-lived cloud keys in CI variables, permissive OIDC trust conditions, roles that any repository can assume.

Question

How does each pipeline and workload get its identity, and who else could get the same identity the same way?

Evidence

CI/CD identity configuration (OIDC versus stored secrets), trust policy conditions, role assumption chains, where pipeline credentials are stored.

Control

OIDC federation with tight subject conditions; no long-lived cloud keys in CI; trust policies reviewed as the identity grants they are.

Trustivan today

Role trust relationships and assumption chains are read onto the graph, with conditions recorded but not evaluated. CI/CD workflow identities and pipeline secrets are not read.

Credentials with no expiry, or an expiry measured in years. A long-lived secret turns a single leak, at any point in its life, into standing access.

Question

How old is the oldest credential that still works, and what does it unlock?

Evidence

Credential age, last rotation, expiry, vault coverage and the identity’s blast radius.

Control

Expiry on everything; rotation schedules owned by an accountable human; short-lived issuance wherever the platform supports it.

Trustivan today

Credential age, rotation-overdue and expiry findings are available as part of Credential Security. Trustivan does not rotate or vault customer credentials.

Identities that can cross from development or staging into production — through shared credentials, cross-account trust, or a pipeline that deploys everywhere with one role.

Question

Can any non-production identity reach a production resource, and by which path?

Evidence

Environment classification per identity and resource; cross-environment reachability and trust analysis.

Control

Environment as a first-class attribute; separate identities per environment; trust relationships that cross the boundary treated as findings.

Trustivan today

An environment can be marked production today, and transitive reach shows what crosses into it as an upper bound. A dedicated cross-environment finding is a future capability.

One identity or one credential doing several jobs — the same service account shared by three services, the same key in four pipelines. Reuse makes rotation risky and blast radius unknowable.

Question

Is the same identity or credential observed from more than one service, host, pipeline or team?

Evidence

Authentication origins per credential; the same credential material referenced by multiple workloads or pipelines.

Control

One identity per workload and purpose; reuse detected and split with the owners involved.

Trustivan today

Credentials are mapped to identities, and a credential shared between agents is a finding. Detecting reuse from authentication origins is a future capability: no connector collects authentication events.

People logging in as machines: a developer using the deploy key to fix production, an administrator using a service account to skip an approval. Accountability disappears and the identity’s behaviour baseline is polluted.

Question

Are there interactive sessions, console logins or unusual origins on identities that should only ever be used by machines?

Evidence

Session type and origin per authentication, attributed to a service identity; deviations from the identity’s normal pattern.

Control

Break-glass paths for humans under their own identities; interactive use of service identities alerted and reviewed.

Trustivan today

No connector collects interactive sessions, and behavioural baselining is not built, by design: nothing constructs the baseline an anomaly would need.