NHI Security Audit Checklist

List every service account, API key, machine token, and agent credential across all environments, production, staging, CI/CD, cloud. Include credentials stored in env vars, config files, secret stores, and pipeline variables.

Why it matters: You cannot secure what you have not counted. Most organizations discover credentials they did not know existed during an incident, not before one.

Pick 5 service accounts at random. Check what they are authorized to do versus what they actually call. Flag any with wildcard permissions, admin access, or access to resources outside their function.

Why it matters: Over-privileged machine credentials are the primary lever for lateral movement after initial access. One compromised credential should not reach your entire infrastructure.

Separate credentials into three groups: auto-rotated, manually rotated on a schedule, and never rotated. For manually rotated credentials, track how often rotations actually happen versus the stated policy.

Why it matters: Rotation reduces exposure window but does not eliminate risk. A credential that exists can be stolen. The goal is eliminating credentials from process memory entirely, not just rotating them faster.

Simulate this: pick a shared service account that multiple workloads use. If it made an unauthorized call at 2am, which workload would you attribute it to? How long would that investigation take? How many teams would need to be involved?

Why it matters: Credential breaches take an average of 292 days to identify and contain, longer than any other attack vector (IBM Cost of a Data Breach, 2024). Attribution gaps are a primary reason incident response takes as long as it does.

Map the network reachability of your most connected service. Check whether workload-to-workload connections are governed by identity-based policy or only by network ACLs. Count how many services share the same credentials.

Why it matters: Flat trust is why breaches spread. Network segmentation alone does not stop an attacker who compromises a workload already inside the perimeter.

Identify every AI agent or LLM-powered workflow that makes outbound calls. For each: what credentials does it use, where are those stored, what can the agent reach, and who controls what it is allowed to do next?

Why it matters: AI agents make non-deterministic execution decisions, they decide what to call at runtime. Traditional IAM assumes predictable workload behavior. Agents break that assumption, and the credentials they hold are exposed for the full duration of the agent's session.

Survey your internal service calls. Separate connections into: mTLS enforced, TLS server-only, and unencrypted. Flag connections that carry sensitive data or access privileged resources but are not mutually authenticated.

Why it matters: mTLS without workload identity is incomplete. Certificates prove a server exists, workload identity proves which specific process is connecting. Server-only TLS allows service impersonation from any process that can reach the network.

Trace a single credential through its full lifecycle: where it is stored, which systems consume it, how long rotation takes end-to-end, whether consumers handle rotation without downtime, and whether downstream systems may have cached it.

Why it matters: A 4-day revocation window on a confirmed breach is 96 hours of live exposure after you know you have a problem. Revocation speed is directly tied to how credentials are managed, static credentials are inherently slow to revoke because they exist in too many places.