The NHI Kill Chain Series

Why credentials fail in production, again and again

The hard part of NHI security is not that new threats appear weekly. It is that the same patterns recur, in different companies, at different times. A departed developer's AWS key stays active for ninety-plus days. A password is hardcoded next to the secrets manager. A single key, never rotated for three years, holds up an entire production stack.

This series documents nine structural failure modes the Cremit research team has observed inside customer environments. Each post takes one credential failure pattern and walks through how it leads to compromise in practice — case study, detection technique, response runbook. Not abstract best practices. Patterns you will recognize immediately if you have seen even one incident.

The final post (#9, the series summary) shows how the eight patterns chain into each other to produce real incidents, and what single principle unifies the fix across all of them.

Real incidents combine two or three patterns at once

Break down a real breach and you will rarely find one cause. The April 2026 Bitwarden CLI npm supply-chain incident combined a Public Key (exposed package), an Aged Key (unrotated CI token), and an Over-shared Key (the same token across several environments). The 2025 tj-actions/changed-files compromise was a Drifted Key (dev-to-prod credential flow) made unrecoverable by an Unattributed Key (no owner could be paged).

You can read each post as a standalone risk and get value. Read the series as a whole and you start being able to debug live incidents in the same vocabulary. Postmortems become "this was a Ghost Key, with an Aged Key on top" — which is much faster than re-deriving the failure shape from first principles every time.

Where to start

Different starting points make sense for different goals. You do not have to read the series in order.

• If you just had an incident: Start with Zombie Key (#5) and Public Key (#7). Those two patterns show up in postmortems most often.
• If you are heading into an audit: Ghost Key (#1), Unattributed Key (#8), and Aged Key (#3). They cover the three gaps an audit will probe — inventory, ownership, rotation policy.
• If NHIs are new to your team: Start with the Series Summary (#9). It shows the whole nine-part picture and links into individual posts for the patterns most relevant to you.
• If you are focused on CI/CD security: Drifted Key (#6) and Over-shared Key (#4). Both walk through how pipelines flatten and duplicate credentials in ways that survive after the pipeline itself is gone.

Each post stands alone. They take the same kind of incident and decompose it from different angles, so reading two or three side by side gives you the pattern- recognition fastest.

Frequently asked questions