Machine identity (non-human identity)

Machine identity covers the credentials and authority of non-human actors: services, workloads, bots, and AI agents. In most enterprises these now outnumber human identities many times over, yet they typically hold long-lived static credentials with no behavioral oversight, which makes unmanaged machine identity one of the largest standing attack surfaces.

The ratio is what makes the credential hygiene problem structural rather than a matter of diligence. Human identities get lifecycle events, joining, moving, leaving, that prompt review; a service credential minted for a migration in 2019 has no such event and no owner once its author moves on.

Long-lived static credentials are also the easiest thing for an attacker to use quietly, because their normal usage pattern is automated and nobody is watching for an unusual login.

The ratio is what makes this structural rather than a matter of diligence. Human identities have lifecycle events, joining, moving, leaving, that force a review; a credential minted for a migration years ago has no such event, no owner once its author moves on, and no expiry that anyone remembers setting.

Detection is harder too, because the normal usage pattern is automated. An attacker using a stolen service credential produces traffic that looks like the service, at the hours the service runs, from infrastructure the service uses, and there is no unusual-login heuristic that fires on it. What does help is the same scoping discipline that applies to agents: narrow the credential's reach so that its misuse is bounded.

The remedies all attack duration rather than breadth. Short-lived credentials minted per task, as just-in-time capability tokens are, remove the standing authority an attacker inherits, which is the property that turns one compromise into lateral movement under standing privilege.

Inventory is the precondition for all of it, and it is the step most organizations discover they cannot complete: naming every non-human identity, its owner, its permissions and its last use is usually a project rather than a query.