OWASP NHI Top 10 – Long-Lived Secrets

Overview

Long-Lived Secrets refer to non-human identity credentials—such as API keys, access tokens, or encryption keys—that persist far longer than necessary. These static, unrotated secrets are high-value targets for attackers because they offer extended or indefinite access once compromised.

What Are Long-Lived Secrets?

In modern SaaS and cloud environments, NHIs rely on secrets to automate system interactions. However, when secrets are configured without expiration or with long durations, they create persistent risk. If such a secret is exposed through a breach or secret leakage, attackers can access critical infrastructure without needing to re-authenticate.

Despite advancements in ephemeral identity solutions like short-lived tokens, many organizations continue to use long-lived secrets due to legacy practices or limited automation.

How Do Long-Lived Secrets Work?

• Secrets, session cookies, and service tokens are created for system access
• These secrets remain valid indefinitely or far beyond acceptable timelines
• Once exposed (via a data leak, misconfiguration, or malware), attackers can use them to bypass MFA and maintain unauthorized access

Example scenarios include:

• Sensitive access tokens found in old data dumps
• Stale credentials still valid months or years after creation

Why Do Long-Lived Secrets Matter?

According to the CSA NHI Report:

• 45% of NHI incidents involved lack of credential rotation
• 51% of organizations have no formal revocation or offboarding process
• Datadog and Orca Security report that 60% of cloud credentials are over a year old

Long-lived secrets compound the impact of breaches. Once leaked, they can be used indefinitely, bypassing controls and escalating into overprivileged NHI abuse or insecure authentication scenarios.

Astrix’s Solution for Long-Lived Secrets

Astrix eliminates the risks of long-lived secrets through full-lifecycle secret governance:

• Discover Non-Human Identities using static or long-lived secrets
• Detect Suspicious Activity tied to stale or reused credentials
• Protect Secrets with automatic rotation, ephemeral replacements, and zero trust principles
• Integrate with secret managers and CI/CD pipelines to replace legacy tokens with dynamic, time-bound alternatives

Astrix empowers teams to enforce short-lived credentials, automate rotation, and revoke secrets before they become attack vectors.

How many of your secrets are older than 90 days? See how Astrix helps eliminate long-lived secrets and secure every phase of the credential lifecycle.

Learn more about the OWASP NHI Top 10 framework in Astrix’s introduction to the standard → Introducing the OWASP NHI Top 10.