The OWASP Non-Human Identities Top 10 is a useful shared vocabulary for the ways machine identities go wrong. The list is owned by OWASP; our contribution here is to translate each category into a question you can ask of your own environment and the evidence a control should be able to produce. Where a control is part of the Trustivan roadmap rather than available today, we say so.
1. Improper offboarding
Question: When a person leaves or a project ends, what happens to the identities they created?
Evidence: ownership records joined to HR or directory offboarding events; identities whose owner is no longer active; last-authentication timestamps.
2. Secret leakage
Question: Where have credentials been copied, and are any of them live?
Evidence: scanning results across code, CI/CD, chat, docs and storage, each mapped to the identity the credential authenticates — not just the string.
3. Vulnerable third-party NHI
Question: Which integrations and vendor identities can act inside our environment, and with what scope?
Evidence: OAuth grants and connected applications with their scopes, owners and last use.
4. Insecure authentication
Question: Are identities authenticating with methods we would not accept from a person?
Evidence: credential type inventory (static keys vs. short-lived tokens vs. workload identity federation), per identity.
5. Overprivileged NHI
Question: What can this identity actually do, versus what it does?
Evidence: effective permission evaluation compared against observed actions; dormant privileges.
6. Insecure cloud deployment configurations
Question: Do our pipelines and workloads obtain identity safely?
Evidence: CI/CD identity configuration (OIDC vs. long-lived secrets), trust policies, role assumption chains.
7. Long-lived secrets
Question: How old is the oldest credential that still works?
Evidence: credential age, rotation history, expiry, vault coverage.
8. Environment isolation
Question: Can a non-production identity reach production?
Evidence: cross-environment reachability and trust analysis.
9. NHI reuse
Question: Is one identity or credential doing several jobs?
Evidence: the same credential observed from multiple services, hosts or pipelines.
10. Human use of NHI
Question: Are people logging in as machines?
Evidence: interactive sessions, console logins or unusual origins attributed to a service identity.
Turning the list into a program
Three patterns repeat across all ten:
- Inventory first. You cannot evidence offboarding, reuse or overprivilege for identities you have not discovered.
- Ownership is the hinge. Almost every remediation requires a human to make a decision. If the owner is unknown, that is the first finding.
- Evidence, not assertion. A control that produces a green checkmark without a timestamped record behind it will not survive an audit, an incident review or a sceptical engineer.
Where Trustivan stands today: identity discovery, classification, ownership, the identity graph, credential age, rotation and exposure findings, effective access as an upper bound and runtime action authorization for agents are available. Rotating or revoking a credential at a provider is not built. We would rather show you the boundary than blur it.