Threat patterns
What is NHI Kill Chain?
Cremit’s editorial series on eight recurring credential risk patterns: Ghost, Shadow, Aged, Zombie, Drifted, Over-privileged, Public and Unattributed. Each pattern is a prompt to investigate ownership, current validity, access and evidence; the label alone does not establish compromise.
Go deeper
More terms in Threat patterns
- Overprivileged NHIA machine identity whose IAM permissions exceed what the workload actually needs. OWASP NHI5:2025 flags this as a top-5 non-human identity risk because the blast radius on compromise is far larger than necessary, a read-only batch job running with admin rights will leak admin-level damage if the credential is stolen. Usually caused by copy-pasting policies, using default roles, or leaving expanded permissions behind after a one-time task.
- Vulnerable Third-Party NHIA third-party NHI is a machine identity or credential used by an external integration to access your systems or data, such as a vendor API key, bot token or OAuth grant. OWASP NHI3:2025 covers risks in these integrations. Record who authorized the connection, what it can access, how it is monitored and how to revoke it.
- Shadow ITAny tool, service, or integration that employees adopt without the security team's knowledge. In the NHI world, shadow IT creates shadow service accounts, shadow API keys, and shadow OAuth grants that never enter the inventory.
- Ghost KeyAn API key or credential that still authenticates, but whose owner has left the company or can no longer be identified. Part of the NHI Kill Chain.
- Over-shared KeyAn over-shared key is one credential copied into multiple projects, environments or tools. Revoking the old value at its issuer disables that value everywhere, but each dependent system needs a replacement and each exposed copy needs review. Shared copies make ownership and migration harder to trace.
- Aged KeyA long-lived credential that has not been rotated in months or years. Time multiplies the damage: the value has had plenty of opportunity to leak, and attackers can plan around its predictable continued validity.