Ghost Credentials: Dormant Non-Human Identities Create Hidden Cloud Attack Paths
Written by AI from the linked story. Not reviewed by an editor. How this works
Organizations accumulate non-human identities (NHIs) — such as service accounts, API keys, and automation tokens — that are provisioned but never properly decommissioned, leaving 'ghost credentials' that remain valid and exploitable long after their intended use. Because these identities are rarely monitored or reviewed, attackers who discover them can leverage established trust relationships to move laterally or escalate privileges within cloud environments without triggering standard detection controls. The core failure is the absence of a systematic identity lifecycle management process that treats NHIs with the same rigor applied to human user accounts. This matters because cloud environments scale NHI proliferation rapidly, making manual tracking impractical and dramatically expanding the attack surface if no automated discovery tooling is in place.
Tactical Insight
Immediate actions
- Conduct an urgent audit of all non-human identities (service accounts, API keys, OAuth tokens) across every cloud environment to identify dormant or unmanaged credentials.
- Deploy an open-source or commercial NHI discovery tool (e.g., NHI Hound) to surface ghost credentials that fall outside existing IAM visibility.
- Revoke or rotate any NHI credential that cannot be attributed to an active, documented business purpose.
Long-term improvements
- Implement a formal NHI lifecycle management policy that mandates provisioning approval, periodic re-certification, and automatic expiration for all non-human identities.
- Enforce least-privilege principles for every NHI so that credentials carry only the minimum permissions required for their specific function.
- Integrate NHI inventory into your CMDB or identity governance platform to ensure continuous visibility as environments scale.
Detection measures
- Enable cloud-native audit logging (e.g., AWS CloudTrail, Azure Monitor, GCP Audit Logs) and alert on authentication events from NHIs that have not been active within a defined threshold (e.g., 90 days).
- Establish behavioural baselines for NHI activity and trigger anomaly alerts when credentials are used from unexpected regions, services, or at unusual times.
- Schedule quarterly automated scans to detect newly orphaned credentials introduced through infrastructure changes or developer activity.