As reported by Dark Reading, security researcher Aleksandr Krasnov has shed new light on the growing threat of non-human identity (NHI) sprawl in cloud environments — and released an open-source tool, NHI Hound, designed to surface hidden trust paths that attackers could exploit. This is a timely and important contribution to a problem that most security teams are woefully underprepared to address.
The Problem Nobody Is Talking About Loudly Enough
Human identity governance has matured considerably over the past decade — MFA, PAM solutions, zero trust frameworks, and identity threat detection are now standard conversation topics in any CISO's playbook. Non-human identities, however, have been allowed to multiply unchecked. Service accounts, API keys, OAuth tokens, CI/CD pipeline credentials, cloud function roles, and inter-service trust relationships now vastly outnumber human identities in most mid-to-large enterprise cloud environments, often by ratios of 10:1 or higher.
The danger isn't just in active credentials — it's in the dormant ones. Ghost credentials are service accounts or API tokens that were provisioned for a project, a contractor, a deprecated microservice, or a one-time integration, and then simply… forgotten. They persist in IAM systems, often retaining permissions that were generous at the time of creation and never pruned. From an attacker's perspective, these are gifts: valid credentials with no active owner, no monitoring, and no one to notice when they're used.
"The most dangerous identity in your cloud environment might be one that hasn't been used in 18 months — precisely because no one is watching it."
Trust Paths: The Hidden Attack Surface
What makes NHI sprawl particularly dangerous is the concept of trust path chaining. A dormant service account with read access to a secrets manager might seem low-risk in isolation. But when you map its relationships — what it can authenticate to, what downstream services trust it, what roles it can assume — a much more dangerous picture can emerge. Attackers who compromise one low-privilege NHI can traverse these implicit trust relationships to reach highly sensitive resources without triggering traditional alert thresholds.
This is precisely why tooling like NHI Hound matters. The ability to enumerate and visualize these trust chains — not just individual identities — is what separates a mature NHI security program from one that simply counts service accounts in a spreadsheet.
Who Is Most at Risk?
The Attacker's Perspective
From an offensive standpoint, targeting NHIs is increasingly attractive because they lack the behavioral baselines that human accounts possess. A human account logging in from a new geography or at 3am may trigger anomaly detection. A service account that suddenly activates after 400 days of dormancy? Most SIEM rules aren't written to flag that — and even when alerts exist, the signal is often deprioritized because the account "should" still be valid.
Nation-state actors and sophisticated ransomware groups have already internalized this. Credential harvesting campaigns increasingly target CI/CD environments, cloud provider CLIs, and developer workstations specifically to collect NHI credentials that provide persistent, low-noise access to cloud infrastructure.
Shield53 Recommendations
Immediate Actions
- Conduct a full NHI inventory now. You cannot protect what you cannot see. Use native cloud IAM tools (AWS IAM Access Analyzer, Azure AD Workload Identity, GCP IAM Recommender) alongside open-source options like NHI Hound to build a comprehensive picture of all non-human identities in your environment.
- Apply a dormancy threshold policy. Any NHI that has not been used in 90 days should be automatically disabled pending review. Any unused for 180+ days should be considered for immediate revocation.
- Implement least-privilege enforcement for service accounts. Audit existing NHI permissions against actual usage patterns using cloud access advisors. Overpermissioned service accounts should be right-sized as a priority remediation activity.
- Map trust paths, not just identities. Use graph-based analysis to understand what an attacker could reach if they compromised each NHI. Prioritize remediation by blast radius, not just by permission level.
- Rotate credentials on a schedule — without exception. Long-lived API keys and service account credentials are a liability. Enforce rotation policies and migrate to short-lived, dynamically issued credentials wherever your platform supports it (e.g., AWS IAM Roles Anywhere, Workload Identity Federation in GCP/Azure).
- Extend your SIEM detection rules. Create alerts for NHI authentication after extended dormancy periods, NHIs authenticating from new source IPs or regions, and any NHI attempting to assume additional roles or escalate privileges.
Strategic Guidance for Security Leaders
NHI governance needs to become a first-class citizen in your identity security program — not an afterthought. Consider appointing explicit ownership for NHI lifecycle management within your IAM team, and integrate NHI risk scoring into your cloud security posture management (CSPM) workflows. The question is no longer whether your organization has ghost credentials — it's how many, and which ones represent the most critical exposure.
