The Modern Dangers of NHI
The modern cloud is 10% human and 90% machine. While we lock down human users with biometrics and keys, the 'Aether' of API keys, bots, and service accounts remains largely ungoverned. These identities operate outside typical identity perimeters and bypass critical choke points like conditional access or network access control lists. They are the silent majority of your infrastructure and are currently the path of least resistance for attackers.
Make the Invisible Visible
You simply cannot secure what you cannot see. Aetherial Security illuminates your infrastructure by mapping your AWS, Azure, and Google Cloud environments directly against these 10 benchmarks. We move beyond static inventory to provide active governance across your entire multi-cloud footprint. This ensures that every hidden risk in your machine layer, including over-privileged service accounts and forgotten keys and tokens, is brought into the light and managed with the same rigor as your human workforce.
The New Standard for Machine Risk
OWASP has released the definitive guide to the risks hiding in your service accounts. Explore the Top 10:
NHI01: Improper Offboarding
Inadequate deactivation or removal of non-human identities when they are no longer needed, leaving "ghost" credentials active in the environment.
NHI02: Secret Leakage
The accidental exposure of credentials—such as API keys, certificates, or tokens—in code repositories, logs, or public buckets.
NHI03: Vulnerable Third-Party NHI
Risks arising from granting excessive permissions to third-party SaaS vendors or integrations that connect to your core infrastructure.
NHI04: Insecure Authentication
The use of weak authentication methods for machines, such as static long-lived keys instead of short-lived, rotated tokens.
NHI05: Overprivileged NHI
Non-human identities granted more permissions than necessary (violating Least Privilege), increasing the blast radius if compromised.
NHI06: Insecure Cloud Deployment Configurations
Vulnerabilities stemming from how secrets and identities are injected or stored within CI/CD pipelines and deployment scripts.
NHI07: Long-Lived Secrets
Credentials that do not expire or are not rotated frequently, giving attackers an indefinite window of opportunity if stolen.
NHI08: Environment Isolation
Lack of segregation between development, staging, and production environments, allowing NHIs to traverse boundaries they shouldn't.
NHI09: NHI Reuse
Sharing the same identity or credentials across multiple services or workloads, making it impossible to audit usage or isolate compromises.
NHI10: Human Use of NHI
Human operators using machine credentials (like service account keys) for manual tasks, bypassing MFA and accountability controls.