Attackers Now Log In With Unmanaged Non-Human Identities

A growing cybersecurity threat sees attackers bypass traditional break-in techniques and instead hijack unmanaged non-human identities such as service accounts, API keys, OAuth tokens, and automation agents. These machine identities now outnumber human users in many organisations and are frequently orphaned, overprivileged or embedded in code and collaboration tools, making them attractive, persistent entry points for attackers.

Industry analysts warn that leaked secrets and misconfigured service accounts fuel breaches and lateral movement, while legacy identity governance tools struggle to discover and manage these assets. Experts say mitigation requires inventorying non-human identities, enforcing least privilege, rotating credentials, and applying automated detection and remediation tied to modern identity governance platforms.

Source: reuters.com