OWASP Finally Ranked Machine Identity Risks. Secret Leakage Beat Almost Everything.
November 6, 2026
Rodney Hall, COO— AI-assisted and reviewed prior to publication.
OWASP's Non-Human Identities Top 10 for 2025 ranks the specific failure modes attackers exploit in service accounts, API keys, and automation credentials, and the list is not led by exotic attack techniques. It is led by expired access that never got revoked and secrets that never got rotated. That ranking should change what security and development teams prioritize this year, because it tells you the fixes are operational, not architectural.
What is the OWASP Non-Human Identities Top 10?
It is the first mainstream, ranked framework for machine identity risk, built the same way the original OWASP Top 10 was: by analyzing real breaches, CVE data, and survey findings rather than theorizing about what could go wrong. The project team pulled from a compilation of high-profile breaches from the past three years involving non-human identity abuse, CVSS severity data from the National Vulnerability Database, and prior survey research including the Verizon Data Breach Investigations Report.
The ten risks run from improper offboarding at the top through secret leakage, vulnerable third-party identities, insecure authentication, overprivileged accounts, insecure cloud deployment configurations, long-lived secrets, poor environment isolation, identity reuse, and humans misusing service accounts for manual work. OWASP describes the project as ranking these risks based on exploitability, prevalence, detectability, and impact, which is why the list reads less like a technical taxonomy and more like a list of what auditors and incident responders keep finding in postmortems.
Why secret leakage outranks almost everything else
Secret leakage sits at number two for a simple reason: it is the risk most directly tied to confirmed compromise. OWASP's ranking notes that compromised credentials are implicated in over 80 percent of breaches, which puts leaked API keys and tokens in the same conversation as phishing and stolen passwords, except machine credentials rarely trigger a login alert or a password reset prompt when they go missing.
The scale of the problem is what makes it hard to dismiss as a hygiene issue. Research cited alongside the OWASP framework found that 70 percent of valid secrets detected in public code repositories in 2022 remained active three years later, and that breaches at organizations including the U.S. Department of the Treasury, Toyota, and The New York Times each began with a leaked or unmanaged machine identity. Secrets scattered across CI/CD pipelines, ticketing systems, and cloud configuration files sit outside the perimeter most security teams actually monitor, which is exactly why they last so long once exposed.
Industry survey data backs this up from a different angle. CyberArk's 2025 State of Machine Identity Security Report found that half of surveyed organizations experienced breaches tied to compromised machine identities, with API keys and TLS certificates leading as the primary entry points attackers exploited to move laterally and access sensitive systems.
Why improper offboarding still beats secret leakage for the top spot
Offboarding failures rank first because they are both common and almost invisible until something goes wrong. OWASP defines improper offboarding as the inadequate deactivation or removal of non-human identities, such as service accounts and access keys, when they are no longer needed, and that gap persists because nobody owns the decommissioning step the way an HR system triggers account removal when a person leaves.
That absence of a lifecycle trigger is the core problem. A service account tied to a retired integration, a key generated for a one-time migration, a bot credential from a vendor relationship that ended eighteen months ago, none of these have a manager who gets a reminder to revoke access. They just sit there, fully privileged, until someone finds them during an audit or an attacker finds them first.
What this means for overprivileged access, not just inventory
Ranking offboarding and overprivileged access near the top of the same list is not a coincidence. A forgotten service account is a low-impact problem only if it was scoped tightly to begin with, and most are not. One industry analysis found that 97 percent of non-human identities carry excessive privileges, and that a small fraction of machine identities, roughly one in ten thousand, control the large majority of cloud resources in a typical environment.
That concentration of access is what turns an overlooked credential into a serious incident. Compromise one of those high-privilege, forgotten accounts and an attacker does not need to escalate further, they already have broad reach. The practical fix recommended alongside this finding is to implement just-in-time access that grants permissions for a specific task and revokes them immediately after, and to automate credential rotation on a defined schedule rather than relying on manual reviews that happen once a quarter, if at all.
The table below maps the three highest-ranked OWASP risks to the control most directly tied to closing them.
| OWASP NHI Risk | Core Failure | Primary Control |
|---|---|---|
| NHI1: Improper Offboarding | No lifecycle trigger for removal | Automated deprovisioning tied to system retirement |
| NHI2: Secret Leakage | Credentials exposed in code or pipelines | Secrets scanning plus mandatory rotation |
| NHI5: Overprivileged NHI | Access scoped broader than function requires | Just-in-time, task-scoped permissions |
Where this fits into a security career, not just a checklist
This framework matters for anyone building or securing software, not only identity specialists. The OWASP project itself is framed around integrating non-human identities into the development lifecycle, which means the fixes belong as much in design and code review as they do in a security operations center. Professionals pursuing the ISC2 CSSLP certification study exactly this intersection, where secure design decisions made during development determine whether a service account gets scoped correctly on day one or becomes next year's audit finding.
That framing also changes how you read a job description or a due diligence questionnaire that mentions machine identity governance. It is no longer a niche IAM concern bolted onto infrastructure teams, it is a software lifecycle responsibility that spans how credentials get issued, rotated, scoped, and retired from the first commit through decommissioning. If your current role touches any part of that pipeline, this is a framework worth knowing in detail rather than skimming once.
If you want a clearer picture of how secure development practices map to real certification paths, the curriculum overview and FAQ on Forge University's resources page breaks down what each credential actually covers before you commit to a study plan. And if you are ready to build that knowledge systematically rather than piecing it together from vendor blog posts, you can start training with a structured plan built around how these risks actually show up in production environments.
The uncomfortable part of the ranking
What the OWASP list does not offer is a shortcut. Every one of the top five risks traces back to process discipline, not a missing tool. Secrets scanners already catch exposed credentials, the problem the data keeps surfacing is that scanning without mandatory rotation and ownership just produces a longer list of known problems that never get fixed.
That is probably the most useful thing about this ranking. It tells security and development teams exactly where effort produces the fastest reduction in real risk, starting with the accounts nobody remembered to remove and the keys nobody rotated after the project that created them ended.