NHI Exposure Score
What is an NHI Exposure Score?
An NHI Exposure Score (Non-Human Identity Exposure Score) is a quantitative cybersecurity risk metric that evaluates the likelihood and potential operational impact of compromise across an organization’s non-human identities (NHIs)
Non-human identities encompass all machine, workload, and programmatic credentials used by automated software, scripts, services, containers, and devices to authenticate and communicate across networks without human intervention. Common examples include:
API keys and bearer tokens
Service accounts and daemon credentials
Workload and cloud-managed identities (e.g., AWS IAM Roles, Azure Managed Identities, GCP Service Accounts)
OAuth access tokens and webhooks
SSH private keys and TLS/SSL certificates
CI/CD automation runners and AI agent credentials
Unlike human users who authenticate interactively using passwords and Multi-Factor Authentication (MFA), NHIs operate programmatically, often outnumber human accounts by a wide margin, and frequently rely on static, long-lived secrets. The NHI Exposure Score measures how visible, over-privileged, and vulnerable these credentials and machine accounts are to external and internal threat actors.
Key Factors Influencing the NHI Exposure Score
The calculation of an NHI Exposure Score synthesizes technical telemetry across several critical risk vectors:
Credential Exposure and Secret Sprawl: Evaluates whether secret keys, authentication tokens, or private certificates are publicly accessible on external platforms such as public code repositories (e.g., GitHub, GitLab), paste sites, developer discussion forums, or unencrypted storage buckets.
Privilege Level and Blast Radius: Measures the level of authority and administrative scope granted to the non-human identity. Scores increase significantly if an identity holds broad administrative entitlements, cross-account access, or bypasses standard least-privilege boundaries.
Credential Hygiene and Lifecycle Management: Analyzes the age, rotation frequency, and expiration parameters of the underlying secret. Long-lived, unrotated, or hardcoded credentials carry higher risk ratings than automated, ephemeral, or just-in-time (JIT) access tokens.
Public Reachability and Network Trust Boundaries: Evaluates whether the services and endpoints authenticated by the NHI are exposed directly to the public internet, located in staging/test environments, or restricted behind network perimeter controls.
Dark Web and Threat Actor Intelligence: Checks whether specific machine tokens, API secrets, or service account identifiers appear in underground cybercrime marketplaces, paste sites, or infostealer malware logs.
Why Scoring Non-Human Identity Exposure is Critical
Organizations prioritize NHI exposure scoring to address systemic vulnerabilities in modern cloud, DevOps, and microservice architectures:
Elimination of Machine Blind Spots: Traditional Identity and Access Management (IAM) tools focus primarily on human employee lifecycles. Scoring NHIs provides visibility into unmanaged machine accounts that operate outside HR onboarding and offboarding workflows.
Neutralization of Lateral Movement Vectors: Threat actors actively target machine accounts because MFA is rarely enforced. Once an attacker extracts an exposed API key or service account token, they can impersonate legitimate system services to pivot into production environments and exfiltrate data.
Detection of Orphaned and Shadow Identities: Development teams frequently create ad hoc service accounts and access tokens for short-term testing. When projects end, these credentials often remain active indefinitely as forgotten, unmonitored backdoors.
Streamlined Security and Compliance Audits: Translates complex machine-to-machine access policies and secret distribution logs into standardized risk metrics required by regulatory frameworks (such as NIST SP 800-53, PCI DSS, SOC 2, and ISO 27001).
Strategies to Reduce and Remediate NHI Exposure
Improving an organization’s NHI Exposure Score requires adopting proactive identity governance and continuous exposure management practices:
Automate Continuous Secret Discovery: Scan public code repositories, dark web dumps, external endpoints, and internal code commits 24/7 to catch expinstantly detectAPI keys and private tokens instantl
Least Privilege and Role-Based Access: Audit machine permissions regularly to remove standing administrative access, restricting each service account to the minimum necessary actions and target resources.
Transition to Ephemeral and Short-Lived Tokens: Replace static, hardcoded API secrets and long-lived private keys with short-lived workload identity federation, automated certificate rotation, and dynamic secrets management vaults.
Maintain a Centralized Machine Identity Inventory: Establish automated tracking that maps every non-human identity to a designated application owner, business unit, workload environment, and purpose.
Frequently Asked Questions
How does an NHI differ from a standard human identity?
A human identity represents an individual person accessing systems via interactive logins using usernames, passwords, and multi-factor authentication (MFA). A non-human identity (NHI) is an automated credential or machine account (such as an API key, service account, or certificate) used by software, scripts, and microservices to communicate programmatically without human intervention.
Why do non-human identities often present greater security risk than human accounts?
Non-human identities outnumber human users by large margins, rarely support multi-factor authentication, and are frequently configured with standing administrative privileges. Additionally, their credentials are often hardcoded into configuration scripts or source code, creating widespread exposure risks.
How do security teams use the NHI Exposure Score in operational workflows?
Security teams use the NHI Exposure Score to prioritize secret revocation and credential rotation workflows, identify over-privileged service accounts, eliminate orphaned machine credentials, and demonstrate identity security posture to executive leadership and compliance auditors.
Operationalizing NHI Exposure Management with ThreatNG
Non-Human Identity (NHI) exposure is a critical, rapidly expanding risk vector across modern enterprises. Non-human identities—such as API keys, service accounts, OAuth tokens, private encryption keys, webhooks, and automated machine processes—now substantially outnumber human identities across enterprise environments. Because these programmatic credentials frequently operate with broad administrative privileges, lack multi-factor authentication (MFA), and persist as long-lived or unmanaged secrets, they represent high-value targets for external threat actors.
ThreatNG operationalizes NHI exposure management and security rating by functioning as an unauthenticated external scout. Unifying External Attack Surface Management (EASM), Digital Risk Protection (DRP), and continuous Security Ratings into a single platform, ThreatNG discovers, evaluates, scores, and monitors an enterprise’s complete public digital perimeter from an outside-in, adversary-centric perspective. It calculates a dedicated NHI Exposure Security Rating without requiring internal software agents, source code access, or connector-based API integrations.
External Discovery
Effectively evaluating non-human identity risk requires uncovering the entire internet-facing footprint where machine credentials, automated endpoints, and shadow services live. ThreatNG achieves complete perimeter visibility through connectorless external discovery.
Connectorless Asset and Perimeter Discovery: ThreatNG maps the entire public-facing digital presence using purely external, unauthenticated discovery with zero internal connectors, software agents, or network credentials. The platform scans public domain registries, DNS zone files, SSL/TLS certificate transparency logs, and BGP routing tables to inventory every public asset.
Patented Recursive Discovery: ThreatNG executes automated recursive discovery to expand outward from a single seed (such as an apex domain, brand name, or ASN). By analyzing newly discovered subdomains and infrastructure, it uncovers forgotten staging environments, test subdomains, and unmanaged cloud instances where automated machine services and API endpoints are exposed without governance.
Invisible Digital Supply Chain Discovery: ThreatNG maps external dependencies across major cloud environments (AWS, Microsoft Azure, Google Cloud Platform) and interconnected SaaS applications. This uncovers shadow automation and uncataloged third-party integrations that use machine-to-machine tokens across the extended enterprise.
External Assessment
ThreatNG provides an objective technical evaluation of machine identity exposures by calculating its proprietary NHI Exposure Security Rating (scored on a standard A-F scale). The score uses a transparent, penalty-based formula derived from empirical discoveries:
Original Value X Base Multiplier X Custom Multiplier = Penalty Deduction
Starting from a baseline score of 100, penalty points are deducted based on the volume, severity weight, and organizational risk appetite across specific exposure vectors:
Detailed Assessment Example 1: Discovered APIs and Webhook Exposure: ThreatNG continuously tracks exposed application programming interfaces and webhook endpoints discovered across mobile applications, subdomains, website control files (e.g., robots.txt, security.txt), and archived web pages. For example, when ThreatNG identifies unauthenticated API endpoints that expose JSON responses with embedded bearer tokens on a staging subdomain, it records the exact endpoint, calculates penalty deductions based on API exposure weights, and factors these directly into the NHI Exposure Security Rating.
Detailed Assessment Example 2: Organization Sensitive Code Exposure (Secret Sprawl): ThreatNG inspects public code repositories and paste sites to identify leaked machine secrets. For instance, when an engineer accidentally commits an AWS Access Key ID, a GitHub personal access token, or a private RSA key associated with an automated build runner, ThreatNG identifies the exact secret category, repository location, and commit timestamp, penalizes the NHI Exposure score, and generates an immediate alert.
Detailed Assessment Example 3: NHI Email Exposure and Infostealer Telemetry: ThreatNG detects leaked machine-to-machine email addresses, automated notification inboxes, and service accounts (such as svc-deploy@, ci-runner@, or alert-bot@) compromised in infostealer malware logs, data breaches, or archived web pages. ThreatNG flags these programmatic accounts because threat actors use them to hijack automated workflows and reset downstream API credentials.
Detailed Assessment Example 4: DNS & Network Exposures: ThreatNG evaluates DNS enumeration vendors and identifies unexpectedly exposed non-standard ports (other than 80 and 443) running automated services, database interfaces, or container orchestration daemons. Discovering unencrypted administrative ports linked to automated scripts triggers deterministic deductions from the NHI rating.
Detailed Assessment Example 5: Mobile Application Secrets Scanning: ThreatNG discovers and analyzes Android (.apk) and iOS (.ipa) mobile application packages published across public app stores. ThreatNG performs deep static analysis to uncover hardcoded backend API keys, OAuth client secrets, and staging server tokens embedded in mobile binaries, factoring these machine credentials directly into the assessment.
Strategic Reporting
ThreatNG standardizes the communication of non-human identity risks by translating complex technical telemetry into structured, auditable records.
NHI Exposure Security Rating Reports: ThreatNG provides dedicated A-F ratings alongside a detailed penalty breakdown. This allows CISOs and security leadership to benchmark NHI exposure across subsidiaries, track remediation over time, and present clear cyber risk metrics to executive boards.
Correlation Evidence Questionnaires (CEQs): ThreatNG dynamically generates CEQs grounded in observed machine identity risks. The CEQ acts as an EASM-to-Audit Translation Layer, transforming uncovered API leaks and exposed service credentials into structured inquiries mapped across Technical, Operational, Strategic, and Financial governance pillars.
Defensible Regulatory Compliance Mapping: ThreatNG maps discovered NHI exposures directly to major cybersecurity frameworks, including NIST SP 800-53, PCI DSS (e.g., non-rotational secret requirements), ISO 27001, SOC 2, and SEC Form 8-K material breach disclosures.
Forensic Evidence Packages: When ThreatNG identifies an exposed secret, dangling machine endpoint, or leaked service account, it packages the exact technical evidence—including URLs, code repository commit links, DNS records, and raw headers—for immediate developer revocation and audit verification.
Continuous Monitoring
Because DevOps pipelines, cloud infrastructures, and automated microservices change constantly, static audits fail to prevent secret sprawl. ThreatNG provides 24/7 continuous external surveillance of the entire machine identity perimeter.
The platform continuously scans for newly exposed APIs, fresh code commits, modified DNS records, and emerging credential dumps in real time. Furthermore, ThreatNG's Overwatch capability provides cross-entity vulnerability intelligence, immediately alerting organizations when newly published zero-day exploits or supply chain vulnerabilities impact machine services deployed across subsidiaries or third-party vendors.
Investigation Modules
ThreatNG features specialized investigation modules that allow risk teams to investigate exposed non-human identities, analyze dependencies, and trace potential exploit paths.
Detailed Module Example 1: Sensitive Code Exposure Module: This module continuously monitors public repositories (such as GitHub, GitLab, Bitbucket) and paste sites for exposed organizational secrets. It uncovers hardcoded API keys, private SSH keys, Jenkins access tokens, and database connection strings committed by internal teams or third-party contractors.
Detailed Module Example 2: The DarChain Exploit Path Mapping Engine: DarChain (Digital Attack Risk Contextual Hyper-Analysis Insights Narrative) connects isolated machine exposures into predictive attack paths. For example, DarChain maps how an attacker discovers an orphaned API endpoint on an unmonitored subdomain, links it to an exposed service account token found in a public repository, and uses that machine identity to access internal databases.
Detailed Module Example 3: Dark Web Presence and Infostealer Intelligence: This module continuously analyzes dark web forums, paste sites, and infostealer malware logs for compromised service accounts, machine-to-machine email addresses, and API authorization tokens.
Detailed Module Example 4: Domain Intelligence and Subdomain Intelligence: The Domain Intelligence module analyzes DNS records, SSL/TLS certificates, and IP infrastructure, while the Subdomain Intelligence module catalogs HTTP/HTTPS status codes (100–599) and inspects server response headers across subdomains to identify exposed microservice gateways.
Detailed Module Example 5: Cybersecurity AI Prompts (DarcPrompt): DarcPrompt packages verified NHI threat context and discovery data into structured prompt blueprints. Through an Air-Gapped Handoff, security analysts safely copy these blueprints into their internal private enterprise AI tools to generate secret-revocation scripts, draft vendor inquiries, and create compliance documentation without exposing sensitive credentials to public AI models.
Intelligence Repositories
ThreatNG enriches its NHI assessments using the DarCache intelligence engine.
DarCache Dark Web & Rupture: Continuously tracks compromised credentials, session tokens, and infostealer logs across all corporate domain permutations, identifying leaked machine credentials circulating on cybercrime forums.
DarCache Vulnerability & eXploit: Integrates NVD data, CISA KEV listings, 30-day EPSS exploit probabilities, and verified Proof-of-Concept exploit code to evaluate whether exposed APIs and machine gateways run vulnerable software versions.
DarCache Bug Bounty: Aggregates and analyzes historical bug bounty disclosures and researcher activity trends to provide empirical data on which machine endpoints, API patterns, and cloud configurations are most frequently targeted and exploited.
DarCache Ransomware: Tracks active ransomware groups and their tactics, techniques, and procedures (TTPs), monitoring whether threat actors are actively leveraging machine identity vectors against target industry sectors.
Cooperation with Complementary Solutions
ThreatNG acts as an unauthenticated external scout, sharing machine identity intelligence with complementary solutions across the security stack.
Cooperation with Secrets Management and Non-Human Identity Management (NHIM) Platforms: ThreatNG shares verified external secret discoveries, exposed API keys, and orphaned machine tokens with complementary solutions. NHIM and secrets vault platforms use this data to initiate automated secret revocation, rotate compromised API keys, and enforce automated lifecycle policies for exposed machine accounts.
Cooperation with Security Orchestration, Automation, and Response (SOAR): ThreatNG delivers pre-correlated Context Objects and DarChain attack paths to complementary solutions via API. When ThreatNG detects a high-severity secret leak on a public code repository, the SOAR platform automatically executes containment playbooks, such as disabling the exposed token, isolating the associated cloud service account, and opening an emergency ticket for the development team.
Cooperation with Cyber Asset Attack Surface Management (CAASM) and CMDBs: ThreatNG feeds newly discovered external API endpoints, shadow cloud services, and exposed non-standard ports into complementary solutions. Asset management teams reconcile these discoveries against internal configuration management databases to catalog previously untracked machine services.
Cooperation with Security Information and Event Management (SIEM): ThreatNG streams external machine identity discoveries, compromised service account emails, and API exposure indicators into complementary solutions. SOC analysts correlate internal authentication logs against these external markers to detect unauthorized API access or machine impersonation attempts.
Examples of ThreatNG Helping Organizations
Uncovering Leaked Cloud Service Account Keys in Public Repositories: An enterprise development team accidentally pushed a repository containing an active cloud service account key with administrative privileges to a public code-sharing platform. ThreatNG's Sensitive Code Exposure module detected the secret within minutes of publication, penalized the organization's NHI Exposure Security Rating, and provided the exact URL and commit hash, allowing the security team to revoke and rotate the key before unauthorized access occurred.
Discovering Unmonitored Staging API Gateways Exposing Tokens: During an unauthenticated external scan, ThreatNG identified an undocumented staging subdomain running an exposed API gateway with debugging mode enabled. The gateway exposed environment variables containing webhook signing secrets and database access tokens. ThreatNG generated a Correlation Evidence Questionnaire (CEQ) and a forensic evidence package, enabling the DevOps team to secure the endpoint and eliminate the exposure.
Examples of ThreatNG Working with Complementary Solutions
Working with Secrets Managers and SOAR to Automate Token Invalidation: When ThreatNG discovers an exposed third-party API secret in a public repository, it transmits a structured Context Object to complementary solutions (SOAR). The SOAR system triggers complementary solutions (secrets management vault) to automatically revoke the compromised token, generate a new cryptographic secret, and deploy the updated key to production workloads without manual intervention.
Working with CAASM and SIEM to Remediate Exposed Machine Ports: ThreatNG identifies an uncataloged server exposing non-standard administrative ports associated with an automated backend process. ThreatNG pushes the endpoint telemetry to complementary solutions (CAASM) to update the asset inventory, while feeding the IP address to complementary solutions (SIEM) to monitor for malicious connection attempts while network firewalls restrict the port.
Frequently Asked Questions
How does ThreatNG discover non-human identity exposures without internal access?
ThreatNG operates as an unauthenticated external scout. It inspects publicly accessible sources across the open, deep, and dark web—including public code repositories, paste sites, dark web infostealer logs, DNS records, website control files, mobile application binaries, and exposed API endpoints—to identify exposed machine credentials and unmanaged automated services.
What is the NHI Exposure Security Rating?
The NHI Exposure Security Rating is ThreatNG's quantitative assessment (scored from A to F) measuring risk across the invisible digital supply chain. It calculates score deductions using a transparent formula based on the volume of exposed APIs, leaked machine emails, exposed non-standard ports, cloud dependencies, and hardcoded secrets found in public repositories.
How does ThreatNG cooperate with complementary security platforms to secure non-human identities?
ThreatNG continuously feeds verified machine identity exposures, leaked secrets, and external asset telemetry into complementary solutions such as secrets management vaults, SOAR playbooks, CAASM databases, and SIEM platforms to drive automated credential revocation, immediate incident containment, and complete asset reconciliation.
