COMMENTARY: The OWASP Non-Human Identities Top 10 ranks improper offboarding as its No. 1 risk and rates its detectability as "Hard." The supporting text says security teams lack effective tools to identify non-human identities that are no longer used. The industry's flagship NHI framework therefore ranks a risk first while conceding that most teams cannot see it.Security teams now have rankings, maturity models, and governance roadmaps for non-human identities. What they still cannot answer is the simpler question: how many do we have, and where are they?NHI programs do not stall on policy. They stall on detection.I should declare an interest. I wrote the Detection Resources page merged into the OWASP project in June 2026. It indexes free, open-source tools against the ten risks. At the time of writing, it lists one tool for one platform, GitHub. That says more about the industry's detection gap than about the project.
Related reading:
First, SaaS and identity-provider admin APIs list third-party applications, service principals, OAuth grants, and their scopes. Google Workspace exposes per-user OAuth tokens through the Directory API's tokens endpoint. Microsoft Entra ID's enterprise applications inventory lists every third-party app granted access to the tenant. Exporting either creates a baseline.Second, consent and audit logs record the moment a new grant is created. In Workspace it is the "authorize" event in the OAuth token audit log. In Entra it is the "Consent to application" audit activity. That is when a new NHI is born. Security teams can alert on grants that request mail, file, directory, or administrative scopes.Third, sign-in trails reveal machine-like patterns: no MFA, fixed source addresses, repeated timing, or use after the human owner has left. None is conclusive alone, but together they make a useful triage queue.
Identity, Application security
Non-human identity (NHI) programs stall on detection, not policy
(Adobe Stock)
Related Events
Get daily email updates
SC Media's daily must-read of the most current and pressing daily news
You can skip this ad in 5 seconds