What to Tell Your Developers About NHI Secrets Security and Governance

The talk addresses non-human identities (NHIs), meaning the service accounts, bots and running workloads that authenticate to other systems using secrets. The speaker argues that these identities now far outnumber human ones, often by around a hundred to one, and that fast, AI-assisted development is multiplying them. Credential misuse is a leading route into breaches, so the speaker frames the problem as a governance gap rather than only a developer mistake.

The middle of the talk walks through the OWASP top ten risks for NHIs, grouped into three buckets for conversations with developers. Themes include assigning a clear owner to each identity, planning offboarding and decommissioning, scoping permissions narrowly instead of granting broad access, avoiding reuse of one identity across environments, and asking whether a human should ever use a given identity. The speaker cites his company's research on public GitHub commits, which found millions of hardcoded secrets added in 2024 and many still valid when rechecked months later.

For practitioners, the closing advice is to raise awareness with the people who write the code first, then set policies, then deploy tools. Technical steps include moving secrets into a secret manager and referencing paths instead of values, rotating credentials automatically, adopting short-lived workload identities, and using Git hooks and pull request checks to block or replace hardcoded secrets. Tooling comes last, and training developers to follow the process is stressed throughout.