Ghost Credentials Expose Cloud Systems to Hidden Identity Risks
Dormant non-human identities pose cloud security risks; new tool finds them.
Security researcher Aleksandr Krasnov has identified a significant security blind spot in cloud environments related to dormant non-human identities (NHIs). These 'ghost credentials' can still grant access and create exploitable trust paths, even if they are no longer actively managed or monitored. To address this, Krasnov has released NHI Hound, an open-source tool designed to help organizations discover and manage these hidden identity risks.
AI summary of the linked source. Not reviewed by an editor. How this works
Run NHI Hound?
Get an email when a new story names NHI Hound, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonOrganizations accumulate non-human identities (NHIs) — such as service accounts, API keys, and automation tokens — that are provisioned but never properly decommissioned, leaving 'ghost credentials' that remain valid and exploitable long after their intended use. Because these identities are rarely monitored or reviewed, attackers who discover them can leverage established trust relationships to move laterally or escalate privileges within cloud environments without triggering standard detection controls. The core failure is the absence of a systematic identity lifecycle management process that treats NHIs with the same rigor applied to human user accounts. This matters because cloud environments scale NHI proliferation rapidly, making manual tracking impractical and dramatically expanding the attack surface if no automated discovery tooling is in place.
What helps against this
How we list vendors- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Identity governance and single sign-on
People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.
- Cyber asset inventory
You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.