Recent SpyCloud data shows that non‑human identities – the AI agents, service accounts, API keys and authentication tokens that machines use to talk to internal systems – have become the most common entry point for attackers, accounting for 31% of reported compromises and nearly twice the rate of traditional phishing (17%). Engineers and operators must treat these machine identities as a critical attack surface because they often hold privileged access, lack clear ownership, and are rarely monitored.
Non‑Human Identities Overtake Phishing as Primary Entry Vector
The survey of 750 security leaders indicates that compromised machine identities are now the leading route into enterprises. While 42% of identity‑based events involve misuse of these identities, only 36% of organizations actually monitor them, despite 95% believing they have sufficient visibility. The gap creates a blind spot that attackers exploit, especially when service accounts remain active for months without credential rotation or MFA challenges.
Governance Gaps Around AI Agents and Service Accounts
AI adoption is pervasive: 91% of respondents run AI tools or agents that access internal applications or data. Yet formal governance exists for just 56% of those privileges; another 41% rely on informal or partial processes, leaving “shadow” access unchecked. Without explicit ownership, service accounts and API keys are provisioned for convenience, often retaining high‑privilege rights without lifecycle management.
Operational Impact: Monitoring, Automation, and Cost
Visibility into session cookies and tokens correlates with lower incident rates (37% vs 50% for organizations lacking that view). Session data has eclipsed passwords as the top attacker target, highlighting the need for session‑level monitoring. Organizations that depend on manual, case‑by‑case remediation report higher incident response costs (39% vs 32%) and greater loss of customer or partner trust (47% vs 36%). The report’s maturity model shows that programs moving toward continuous monitoring and automated remediation see fewer events.
Related CloudNinjas coverage: security.
What This Means For Practitioners
Engineers should treat machine identities with the same rigor applied to human accounts. Consider the following actions:
- Inventory and ownership: Extend existing asset inventories to include every service account, API key, AI agent and token. Assign clear custodians responsible for lifecycle actions.
- Credential hygiene: Implement automated rotation for secrets and enforce MFA or equivalent challenge mechanisms where possible.
- Continuous monitoring: Deploy tools that can detect anomalous usage of non‑human identities, including unexpected session token reuse or access from new IP ranges.
- Automation of remediation: Integrate detection with automated revocation or credential reset workflows to reduce manual response time.
- Third‑party exposure verification: Establish a repeatable process to confirm that any vendor‑related identity exposure has been fully remediated, addressing the 40% of organizations that currently lack such a process.
By closing the visibility gap and treating machine identities as first‑class security objects, teams can reduce the frequency and impact of identity‑based incidents and align with the higher‑maturity tiers identified in SpyCloud’s model.
