HACKING PROJECT · cloud · Advanced
Non-Human Identity (NHI) Auditing Tool
Continuously discover, risk-score, and right-size every non-human identity across an organization's cloud and SaaS estate.
Modern environments contain far more non-human identities — service accounts, API keys, OAuth tokens, workload identities, secrets, and bots — than human users, yet they are rarely inventoried, rotated, or scoped correctly. Over-privileged and stale NHIs are a leading path to lateral movement and cloud breaches (leaked keys, orphaned service principals, long-lived tokens). Most IAM tooling is built around humans, leaving NHIs as an unmanaged, high-risk blind spot.
**What you'll build**
Build an NHI auditing tool that discovers and inventories all non-human identities across cloud and SaaS providers, then scores each on privilege, age, usage, rotation status, and blast radius. The tool detects over-permissioned roles, stale keys, wildcard policies, and unused entitlements, mapping findings to least-privilege recommendations aligned with NIST 800-207 Zero Trust. Output includes prioritized remediation, ownership attribution, and drift monitoring so NHI risk is continuously governed rather than audited once a year.
**Objective** — Continuously discover, risk-score, and right-size every non-human identity across an organization's cloud and SaaS estate.
**Expected outcome** — A working NHI discovery-and-audit tool that outputs a scored identity inventory with least-privilege and rotation remediation for a live cloud/SaaS environment.
**Difficulty** — Advanced — requires deep multi-cloud IAM knowledge, entitlement analysis, and secure API integration across providers.
**Primary category** — IAM / Cloud Security; Secondary = CIEM, Zero Trust, Attack Surface Management
**Security domains** — Primary = Cloud Security; Secondary = Blue Team, GRC, DevSecOps
**Technical focus** — Non-human identity governance, CIEM, least-privilege analysis, secret/key discovery, entitlement mining, OAuth/token auditing, workload identity, policy analysis, blast-radius scoring, drift detection
**Core technologies** — Languages: Python, Go; Frameworks/Libraries: cloud SDKs (boto3, Azure SDK, Google Cloud SDK), FastAPI; Security Tools: cloud IAM policy analyzers, Prowler, ScoutSuite, PMapper-style graph analysis, secret scanners; Cloud/Infra: AWS IAM/STS, Azure Entra ID, GCP IAM, Kubernetes service accounts, Terraform; AI/Data: graph analytics, anomaly detection for identity usage; Databases: Neo4j or graph store, PostgreSQL
**Where it's valued** — Cloud-native enterprises, fintech, SaaS, MSSPs, any org with large multi-cloud footprints
**Careers it builds toward** — Cloud Security Engineer, IAM Engineer, CIEM Specialist, Zero Trust Architect, DevSecOps Engineer
**Framework alignment**
• MITRE ATT&CK: Credential Access — Unsecured Credentials (T1552), Steal Application Access Token (T1528); Persistence/Privilege Escalation — Valid Accounts: Cloud Accounts (T1078.004); Lateral Movement — Use Alternate Authentication Material (T1550)
• NIST CSF 2.0: Identify (primary), Protect, Detect; NIST 800-207 Zero Trust as the governing model
• OWASP: API Top 10 (API2 Broken Authentication, API3 Broken Object Property Level Authorization, API5 Broken Function Level Authorization)
• CIS Controls v8: 5 (Account Management), 6 (Access Control Management), 3 (Data Protection for secrets)
**Innovation** — Startup Potential — NHI security is one of the hottest emerging categories with active acquisition interest, and a multi-cloud auditor with blast-radius scoring is commercially compelling. Scores: Innovation 8/10, Startup 9/10, Enterprise-Readiness 7/10, Patent = Possible.