[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fwYRxMu6UyzKqWa3ElqXVMqzwIGE6UhgtkwWbzpYdKpA":3},{"article":4,"iocs":51,"watch_terms":52,"solutions":53,"lesson":142},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"195c70e8-ec8b-47ec-add9-dba0eebd97c5","Ghost Credentials Expose Cloud Systems to Hidden Identity Risks","ghost-credentials-expose-cloud-systems-to-hidden-identity-risks-331be8","Security researcher Aleksandr Krasnov reveals dormant non-human identities can create security blind spots and releases NHI Hound, an open source tool to sniff out trust paths.","Security researcher Aleksandr Krasnov has identified a significant security blind spot in cloud environments related to dormant non-human identities (NHIs). These 'ghost credentials' can still grant access and create exploitable trust paths, even if they are no longer actively managed or monitored. To address this, Krasnov has released NHI Hound, an open-source tool designed to help organizations discover and manage these hidden identity risks.","Dormant non-human identities pose cloud security risks; new tool finds them.","https:\u002F\u002Fwww.darkreading.com\u002Fcloud-security\u002Fnon-human-identity-sprawl-creates-a-new-cloud-attack-path","https:\u002F\u002Feu-images.contentstack.com\u002Fv3\u002Fassets\u002Fblt6d90778a997de1cd\u002Fblt30bed8fd33fe3bfb\u002F6888bea8af946d84d071204f\u002Fghost-igor-Stevanovic-alamy.jpg?width=720&quality=80&disable=upscale","2026-07-28T21:33:23+00:00","2026-07-29T00:00:21.850375+00:00",7,[17,20,23],{"name":18,"type":19},"NHI Hound","product",{"name":21,"type":22},"non-human identities","technology",{"name":24,"type":22},"cloud systems","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":25,"icon":27,"name":28,"slug":29},null,"Threat Intelligence","threat-intelligence",[31,36,41,46],{"category":32},{"id":33,"icon":27,"name":34,"slug":35},"02371804-cf6d-4449-98de-f1a2d4d9b266","Tools","tools",{"category":37},{"id":38,"icon":27,"name":39,"slug":40},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":42},{"id":43,"icon":27,"name":44,"slug":45},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",{"category":47},{"id":48,"icon":27,"name":49,"slug":50},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",[],[18],{"controls":54,"vendors":141},[55,84,113],{"slug":56,"name":57,"problem":58,"products":59},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[60,68,76],{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"slug":85,"name":86,"problem":87,"products":88},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",[89,97,105],{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"omada","Omada","\u002Fvendor-logos\u002Fomada.png","omada-identity-cloud","Omada Identity Cloud","https:\u002F\u002Fomadaidentity.com\u002Fproducts\u002Fomada-identity-cloud\u002F","Identity governance and administration delivered as a service.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"sailpoint","SailPoint","\u002Fvendor-logos\u002Fsailpoint.png","human-fabric","SailPoint Human Fabric","https:\u002F\u002Fwww.sailpoint.com\u002Fproducts\u002Fhuman-fabric","Identity governance platform, the successor to Identity Security Cloud: lifecycle management, access requests and continuous access reviews.",{"slug":114,"name":115,"problem":116,"products":117},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[118,126,134],{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-cyber-assets","Axonius Cyber Assets","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fcyber-assets","A continuously reconciled view of every asset, who owns it, which security controls cover it and where it drifts from policy.",{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":138,"product_name":136,"url":139,"description":140},"lansweeper","Lansweeper","\u002Fvendor-logos\u002Flansweeper.png","lansweeper-asset-inventory","https:\u002F\u002Fwww.lansweeper.com\u002Fproduct\u002Fasset-inventory\u002F","Discovery with and without agents that keeps one central, always-updated inventory of devices, software and their details.",[],{"slug":143,"title":144,"body":145,"framework_refs":146,"framework_notes":159},"ghost-credentials-dormant-non-human-identities-create-hidden-cloud-attack-paths","Ghost Credentials: Dormant Non-Human Identities Create Hidden Cloud Attack Paths","Organizations accumulate non-human identities (NHIs) — such as service accounts, API keys, and automation tokens — that are provisioned but never properly decommissioned, leaving 'ghost credentials' that remain valid and exploitable long after their intended use. Because these identities are rarely monitored or reviewed, attackers who discover them can leverage established trust relationships to move laterally or escalate privileges within cloud environments without triggering standard detection controls. The core failure is the absence of a systematic identity lifecycle management process that treats NHIs with the same rigor applied to human user accounts. This matters because cloud environments scale NHI proliferation rapidly, making manual tracking impractical and dramatically expanding the attack surface if no automated discovery tooling is in place.",[147,148,149,150,151,152,153,154,155,156,157,158],"CIS Control 5: Account Management","CIS Control 6: Access Control Management","CIS Control 8: Audit Log Management","NIST SP 800-53 AC-2: Account Management","NIST SP 800-53 AC-3: Access Enforcement","NIST SP 800-53 IA-4: Identifier Management","NIST SP 800-53 AU-6: Audit Record Review, Analysis, and Reporting","NIST CSF PR.AC-1: Identities and credentials are managed for authorized devices and users","NIST CSF DE.CM-3: Personnel activity is monitored to detect potential cybersecurity events","ISO\u002FIEC 27001:2022 A.5.16: Identity Management","ISO\u002FIEC 27001:2022 A.8.2: Privileged Access Rights","GDPR Article 32: Security of Processing (access control obligations)",{"CIS Control 5: Account Management":160,"CIS Control 8: Audit Log Management":161,"NIST SP 800-53 AC-2: Account Management":162,"NIST SP 800-53 AC-3: Access Enforcement":163,"CIS Control 6: Access Control Management":164,"NIST SP 800-53 IA-4: Identifier Management":165,"ISO\u002FIEC 27001:2022 A.5.16: Identity Management":166,"ISO\u002FIEC 27001:2022 A.8.2: Privileged Access Rights":167,"NIST SP 800-53 AU-6: Audit Record Review, Analysis, and Reporting":168,"GDPR Article 32: Security of Processing (access control obligations)":169,"NIST CSF PR.AC-1: Identities and credentials are managed for authorized devices and users":170,"NIST CSF DE.CM-3: Personnel activity is monitored to detect potential cybersecurity events":171},"Account management includes decommissioning service accounts and API keys when no longer needed, the gap behind ghost credentials.","Audit logs help detect dormant service accounts suddenly becoming active, a sign of ghost credential abuse.","Account management requires reviewing and removing unused accounts, including non-human identities.","Access enforcement should apply to service accounts and tokens as strictly as to human users.","Access control management limits what non-human identities can reach, reducing the damage from forgotten credentials.","Identifier management includes tracking and retiring identifiers for service accounts and automation.","Identity management covers the full lifecycle of non-human identities, including decommissioning.","Privileged access rights should be reviewed regularly, including for powerful service accounts.","Reviewing audit records for unused or anomalous non-human identity activity helps detect abuse.","Access control obligations extend to service accounts that can reach personal data.","Managing identities and credentials includes non-human identities that are often overlooked.","Monitoring activity helps spot misuse of dormant service accounts and API keys."]