ContactBook a demo

NHI Risk Management

Risk you can explain.Findings you can act on.

A risk score nobody can explain is a number nobody will act on. Trustivan builds risk from the findings behind it — privilege, production and sensitive access, credential age and exposure, ownership, inactivity and lifecycle — and answers nine questions for every finding, with the evidence attached.

Risk from findings, with evidence: availableBehavioral anomaly scoring: not built
Book a demoExplore NHI Risk

An explainable score — every point traced to a finding, never a black box

HighOrphaned identityLong-lived credential

Orphaned service identity with reachable production data

Why
Orphaned service account still holds active production credentials
What
svc-billing-export (service identity)
Who
Owner unknown — no owner tag and no assigned owner
Where
cloud account prod-core · region eu-west-1
How
Long-lived access key (age 611 days), still active, on a machine IAM user
Blast radius
2 production databases, 1 backup bucket, 4 downstream services
Recommendation
Assign owner, rotate to short-lived credential, scope role to export-only
Action
Propose remediation · assign owner · quarantine in platform
Evidence
AWS IAM sync 2026-08-19 · access-key metadata · owner tag absent
Evidence before claims — when evidence is missing, Trustivan shows unknown, never a fabricated score.Illustrative finding · sample environment

The need

Scores created the backlog. Explanations clear it.

Four habits of conventional risk scoring — and what a non-human identity risk program actually needs instead.

  • Prioritization

    Conventional scoringA single score ranks everything

    An NHI risk program needsAnalysts need to know which factor moved the score and which evidence supports it before they spend a day on it

  • Ownership

    Conventional scoringFindings land in the security queue

    An NHI risk program needsThe fix belongs to the identity’s owner, who needs identity context — not a vulnerability-style alert

  • Remediation

    Conventional scoringClose the finding

    An NHI risk program needsRotate, scope, reassign or retire — each with dependencies, verification and a record

  • Coverage

    Conventional scoringRisk stops at the cloud account boundary

    An NHI risk program needsRisk follows the identity across clouds, SaaS tenants, pipelines, data platforms and agents

Risk model

Every factor named. No black box.

A score is the sum of contributions from findings, each naming its factor and its evidence. Each factor shows what it is built from and its availability.

How Trustivan maps to it

Prioritize by consequence. Explain by evidence. Remediate by owner.

Three moves that turn a list of findings into a program the rest of the company will cooperate with.

Prioritization

A backlog ordered by what a compromise would actually reach

Two findings with the same label rarely carry the same consequence. Trustivan ranks by the contributions that add up — a long-lived key on an identity that reaches production data outranks a hundred stale keys on sandboxes — and shows which factors produced the rank.

  • Factor contributions visible per finding, so a reviewer can see what moved it up.
  • Blast radius from effective access as a first-class input, computed on the graph as an upper bound.
  • Unknown factors are shown as unknown and never silently treated as low.
Available
Nine questions

Every finding answers why, what, who, where, how — and what it would cost

Why it matters, what the identity is, who owns it, where it lives, how it authenticates, what it can reach, what to do, which action to take and which records prove it. The same nine fields for an orphaned service account, a shared credential or an overprivileged agent.

  • Source records attached with timestamps: IAM snapshots, credential metadata, exposure records, ingested activity.
  • Recommendation and action are separate, so the fix is specific and the workflow is traceable.
  • Findings are stable objects with history — re-scored when evidence changes, never reset.
Read why risk must be explainable
MediumSharedCross-environmentLong-lived

Credential shared by three agents across staging and production

Why
One credential is held by three agents in two environments, so revoking it has three blast radii
What
aws-access-key/AKIA…R2WN (credential held by etl-agent, etl-agent-stg and report-agent)
Who
Owner: Data services (declared) · report-agent: owner unknown
Where
AWS account analytics-prod · environments prod and staging
How
The same credential fingerprint is recorded against three agent identities; last rotated 300 days ago
Blast radius
Reach to 64 resources, 3 classified high impact · effective access, an upper bound
Recommendation
Issue one credential per agent, give report-agent an owner, retire the shared key last
Action
Propose rotation for second-person approval · assign owner · 3 holders listed
Evidence
Credential fingerprint index · access key metadata · entitlement records
Nine questions, source records attached. Missing evidence is shown as unknown.Illustrative finding · sample environment
Remediation workflows

Remediation from the finding, routed to the person who can fix it

The owner receives the finding with its identity context and the actions that apply: assign an owner, quarantine in the platform, notify, record a ticket, propose a revoke or a rotation. A second person approves, each step is recorded, and the finding re-evaluates when the evidence changes.

  • Owner routing from the graph, with the unowned case raised as its own finding.
  • Platform actions complete: quarantine, owner assignment, ticket and notification records.
  • Provider-side revocation and rotation are proposed and approved but not executed — no provider executor is registered.
Provider execution: future capability
See the overprivileged NHI use case

Outcomes

A risk program people outside security will cooperate with

Because every finding explains itself and lands with its owner, remediation stops being a negotiation.

A ranked backlog

Findings ordered by severity and risk contribution — not by volume or by which scanner shouted loudest

Explainable scores

Every score decomposes into contributions with evidence, so reviewers can challenge it

Owner-routed remediation

Findings go to the identity’s owner with the context needed to fix them

Blast radius first

Know what a compromised identity reaches before choosing what to fix

A trend you can defend

Risk over time from recorded risk snapshots, built from the same evidence

Board-ready evidence

Reports backed by source records, never by invented metrics

Related use cases

The findings a risk program is built to surface

Each scenario walks through the factors involved and what the evidence looks like.

All use cases

Related needs

Risk reads from every other program

Governance supplies owners and lifecycle, access intelligence supplies reachability, agent security supplies the newest population.

All solutions

Replace the score with an explanation.

See how TRUSTIVAN connects identity, credential, access, agent and action context into one control plane.

Book a demo