Identity laundering is the reuse or disguise of identities so that actions appear more trustworthy or less traceable than they really are. In AI contexts, it can involve creating multiple accounts, shifting between them, or handing them off across runs to preserve access.
Expanded Definition
Identity laundering is a deceptive identity pattern in which a person, service, or AI agent reuses, rotates, or disguises identity artifacts so actions look more legitimate, continuous, or disconnected than they really are. In security operations, that can mean switching accounts, inheriting an already trusted session, using proxy credentials, or moving activity across linked personas to obscure attribution. In identity and AI security, the concern is not only who is acting, but whether the apparent identity reflects the true actor, authority, and intent. This is closely related to Non-Human Identity governance when bots, scripts, or agents are involved, because weak lifecycle controls make it easier to recycle access and hide ownership. NIST guidance on access control and account management, including the NIST SP 800-53 Rev 5 Security and Privacy Controls, is often used as a reference point for the underlying control expectations.
Definitions vary across vendors because the term is not a formal control label in most standards. In practice, it is best treated as an abuse pattern that spans IAM, PAM, NHI, fraud detection, and AI agent governance rather than a single technology problem. The most common misapplication is calling any account sharing identity laundering, which occurs when there is no intent to obscure provenance or preserve a false trust relationship.
Examples and Use Cases
Implementing identity controls rigorously often introduces friction for legitimate users and machine workflows, requiring organisations to weigh traceability against operational speed.
- An AI agent completes multiple workflow runs under different service accounts so failed actions cannot be tied back to one owner, making OWASP guidance for AI applications relevant when identity continuity affects accountability.
- A contractor reuses a trusted employee account after approval ends, then forwards access through secondary credentials to avoid revalidation and monitoring.
- A fraud actor opens several consumer accounts, slowly maturing each one, then transfers value between them to make the activity appear normal and less traceable.
- A privileged automation script inherits a long-lived token from a pipeline account, masking the real origin of the action and weakening audit trails.
- An organisation allows shared admin credentials during an incident, then never unwinds them, creating a path where later actions cannot be tied to a named operator.
For identity verification and assurance, the boundary matters: a strong onboarding check does not prevent laundering if the same identity is later repurposed, rotated, or passed along without lifecycle controls. That is why account provenance, session continuity, and handoff rules need to be treated as security controls, not only convenience features.
Why It Matters for Security Teams
Identity laundering undermines attribution, access governance, and incident response because defenders lose confidence in which identity truly performed an action. That weakens alert triage, complicates forensic reconstruction, and can let malicious behaviour blend into normal account churn. For AI and NHI environments, the risk is amplified when autonomous agents can create, inherit, or delegate credentials faster than humans can review them. Security teams should therefore treat identity lineage, token ownership, and handoff visibility as first-order controls, alongside least privilege and periodic access review. NIST control families covering identification, authentication, account management, and audit logging are especially relevant, and zero trust programs should assume that an apparent identity may not equal the original actor. A useful operational reference for control discipline is NIST SP 800-53 Rev 5 Security and Privacy Controls, particularly where account lifecycle and logging need stronger enforcement.
Organisations typically encounter the damage only after a suspicious sequence cannot be attributed with confidence, at which point identity laundering becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and OWASP Agentic AI Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST SP 800-63 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | Covers non-human identity abuse patterns, including disguised or recycled service identities. | |
| OWASP Agentic AI Top 10 | Addresses agentic workflows where identity handoffs can obscure accountability. | |
| NIST CSF 2.0 | PR.AA | Identity and authentication outcomes depend on trustworthy account and access management. |
| NIST SP 800-63 | AAL2 | Digital identity assurance helps limit misuse of weak or repurposed credentials. |
| NIST Zero Trust (SP 800-207) | Zero trust assumes identities and sessions must be continuously re-evaluated. |
Track NHI ownership, lifecycle, and token use so reused identities cannot hide behind trusted automation.
