Research, Playbooks, and Tools
Everything we publish to help you run a serious Non-Human Identity program.
Blast Radius: a field playbook for leaked API keys
Six phases for AWS, GCP and Azure: document the exposure without delaying containment, then assess available logs and AWS's compromised-key quarantine policy. No form required.
Free PDF · English & Korean · Published 4 September 2026 · Revised 4 October 2026
Tools
Interactive assessments you can run in your browser.
Series
Multi-part research we publish over weeks, not one-off posts.
Monthly NHI research brief
New playbooks, frameworks, and field reports: one email a month.
NHI Kill Chain
Eight credential risk patterns, with investigation points and a summary article.
Reports
Industry analysis, frameworks, and field reports from the front line.
Blast Radius: Leaked API Key Playbook
A field playbook for leaked API keys across AWS, GCP and Azure: contain the key, inspect available logs, and assess permissions and evidence gaps.
RSAC 2026 NHI field notes
Cloud Village CTF, published vendor scope, and four questions for evaluating NHI tools.
NHI Security Checklist
Five evidence checks for inventory, exposure, validity, response, and follow-up.
When reading is not enough
See how Cremit actually inventories, verifies, and tracks Non-Human Identities to an owner in live environments.