How HubSpot Budgeted & Implemented NHI Security
In this spotlight session from the CSA Non-Human Identity Summit, we sat down with Harsh Patel, Enterprise Application and IAM Engineer at HubSpot, to hear how his team made Non-Human Identity security a strategic priority—before a breach forced the issue. Moderated by Jonathan Sander, Field CTO at Astrix Security, the conversation explored how Harsh identified hidden risks in HubSpot’s environment, made the case for proactive investment, and built a system that keeps NHI access aligned with business needs.
Whether you’re just starting your NHI journey or pushing for more internal buy-in, this session offers a practical, forward-looking view into what effective NHI security looks like in real-world environments. From budget conversations to implementation tradeoffs, Harsh shares hard-won lessons on where to focus first, how to engage stakeholders, and what pitfalls to avoid when scaling your program.
“We didn’t have an incident, but we did find unused credentials with broad access just sitting there — low-hanging fruit for attackers. That’s why a tool like Astrix helped us be more proactive than reactive. We could address those exposures before they turned into problems.”
Key highlights:
Getting ahead without a breach: HubSpot didn’t wait for an incident. Instead, they compared their mature human access controls to their fragmented NHI landscape and found a major gap — one they decided to close before attackers found it.
AI agents as privilege escalators: As AI agents gained access to SaaS apps and internal systems, users could leverage those agents to bypass their own access restrictions. Harsh flagged this as an emerging vector for indirect privilege escalation.
Driving visibility with automation: The goal wasn’t just to audit what existed — it was to build a system that automatically reviewed new NHIs, revoked stale access after 90 days, and reduced risk without slowing down engineering velocity.
Budgeting through real-world proof: Instead of theoretical slides, the HubSpot team built internal buy-in through a proof of concept. By mapping risks to known industry incidents and showing how Astrix could reduce the attack surface, they secured budget and cross-team support.
Cloud-first made clarity harder: With most of HubSpot’s infrastructure in SaaS, visibility over NHI access was limited. Astrix provided a “single pane of glass” to understand what identities existed, what they had access to, and where privileges had quietly accumulated.