Non-human identity (NHI) programs stall on detection, not policy

COMMENTARY: The OWASP Non-Human Identities Top 10 ranks improper offboarding as its No. 1 risk and rates its detectability as "Hard." The supporting text says security teams lack effective tools to identify non-human identities that are no longer used. The industry's flagship NHI framework therefore ranks a risk first while conceding that most teams cannot see it.

Security teams now have rankings, maturity models, and governance roadmaps for non-human identities. What they still cannot answer is the simpler question: how many do we have, and where are they?

NHI programs do not stall on policy. They stall on detection.

I should declare an interest. I wrote the Detection Resources page merged into the OWASP project in June 2026. It indexes free, open-source tools against the ten risks. At the time of writing, it lists one tool for one platform, GitHub. That says more about the industry's detection gap than about the project.

Secrets scanning searches under the lamppost

Secrets scanning is useful, but it finds credentials somebody wrote down. Many SaaS-native identities are created without placing a secret in a repository. An OAuth grant appears after a user accepts a consent screen. A service account is created in an admin console. There may be no string in source code to match.

The 2025 Salesloft Drift breach demonstrated the distinction. Google's Threat Intelligence Group documented attackers using compromised OAuth tokens and legitimate API calls to export data from Salesforce instances. The access came through a third-party integration, not a hardcoded secret in each victim's repository. Repository scanning could not inventory that OAuth access, but admin APIs and audit logs could.

Three existing sources can expose these identities.

Related reading:

First, SaaS and identity-provider admin APIs list third-party applications, service principals, OAuth grants, and their scopes. Google Workspace exposes per-user OAuth tokens through the Directory API's tokens endpoint. Microsoft Entra ID's enterprise applications inventory lists every third-party app granted access to the tenant. Exporting either creates a baseline.

Second, consent and audit logs record the moment a new grant is created. In Workspace it is the "authorize" event in the OAuth token audit log. In Entra it is the "Consent to application" audit activity. That is when a new NHI is born. Security teams can alert on grants that request mail, file, directory, or administrative scopes.

Third, sign-in trails reveal machine-like patterns: no MFA, fixed source addresses, repeated timing, or use after the human owner has left. None is conclusive alone, but together they make a useful triage queue.

A 30-day detection pass

Week one is for counting. Export third-party applications and grants from the identity provider and the two most important SaaS platforms. Record the scopes, install date, installer, last use, and current owner.

Week two is for watching births. Route consent and token-authorization events into the existing log platform. Start with one alert for any new grant requesting sensitive scopes.

Week three is for triage. Ask who approved each privileged grant, whether that person still works for the organization, and whether the grant has been used recently. Revoke only after checking dependencies, but do not leave ownerless access unexamined.

Week four is for ownership and repetition. Assign accountable owners to the most privileged grants, schedule the exports to run weekly, and alert on the difference. A scheduled export and a diff are not elegant, but they are a detection program.

This first pass will miss cloud workload identities and platforms that are not queried. It is still more useful than applying policies to an inventory that does not exist.

OWASP has ranked what goes wrong. The next useful community artifact is a public, vendor-neutral library of detection queries: the Workspace filter that surfaces unattended grants, the Entra query that flags a service principal active after its owner left, and the Salesforce report that lists connected apps by last use. The frameworks exist. The queries are barely started.