What is Zombie Key?

Cremit’s editorial series on eight recurring credential risk patterns: Ghost, Shadow, Aged, Zombie, Drifted, Over-privileged, Public and Unattributed. Each pattern is a prompt to investigate ownership, current validity, access and evidence; the label alone does not establish compromise.

A machine identity whose IAM permissions exceed what the workload actually needs. OWASP NHI5:2025 flags this as a top-5 non-human identity risk because the blast radius on compromise is far larger than necessary, a read-only batch job running with admin rights will leak admin-level damage if the credential is stolen. Usually caused by copy-pasting policies, using default roles, or leaving expanded permissions behind after a one-time task.

A third-party NHI is a machine identity or credential used by an external integration to access your systems or data, such as a vendor API key, bot token or OAuth grant. OWASP NHI3:2025 covers risks in these integrations. Record who authorized the connection, what it can access, how it is monitored and how to revoke it.

Any tool, service, or integration that employees adopt without the security team's knowledge. In the NHI world, shadow IT creates shadow service accounts, shadow API keys, and shadow OAuth grants that never enter the inventory.

An API key or credential that still authenticates, but whose owner has left the company or can no longer be identified. Part of the NHI Kill Chain.

An over-shared key is one credential copied into multiple projects, environments or tools. Revoking the old value at its issuer disables that value everywhere, but each dependent system needs a replacement and each exposed copy needs review. Shared copies make ownership and migration harder to trace.