NIST IR 8587: Token Security Is Now a Non-Human Identity Problem

NIST IR 8587 addresses token security as a non-human identity problem, warning that API tokens, OAuth credentials, personal access tokens, cloud credentials and service-account secrets can grant direct access to infrastructure, repositories, SaaS applications and AI platforms after an endpoint is compromised. The publication notes these credentials have their own lifecycle, so resetting an employee's password does not necessarily revoke the access those tokens provide.