Stealthing is the covert use of a trusted identity, account, or process to operate inside a system without triggering normal security alerts. In identity security, it describes hidden persistence, silent privilege use, or disguised activity by an NHI, agent, or attacker that blends into legitimate operations and evades monitoring.
What stealthing means in identity security
Stealthing is not just hidden access, it is access that is intentionally made to look normal. The key security issue is that the actor uses a trusted identity path, so the activity inherits legitimate trust signals and can remain invisible to routine monitoring.
That matters because many controls are tuned to stop obvious misuse, not to distinguish a sanctioned-looking action from an unsanctioned one. MITRE ATT&CK Enterprise Matrix is useful here because stealthy persistence often overlaps with credential access, privilege escalation, and lateral movement techniques that defenders must correlate over time.
How stealthing works inside trusted environments
Stealthing typically succeeds when the attacker, agent, or abused process stays within expected behavioural bounds, for example by using normal authentication paths, quiet timing, approved tooling, or low-noise commands. The activity may be malicious even when each individual action appears ordinary.
This is why stealthing is often a monitoring problem as much as an access problem. If telemetry focuses only on failed logins, denied requests, or high-volume anomalies, it can miss low-and-slow abuse that blends into baseline administration or automation.
In systems with machine or service identities, the risk is amplified when a trusted workflow can act with broad standing privileges. OWASP Non-Human Identity Top 10 helps explain why overprivilege, long-lived secrets, and weak lifecycle controls create conditions where stealthy use becomes hard to distinguish from legitimate automation.
Why stealthing is hard to detect
Stealthing is dangerous because it exploits trust, not just technical gaps. A hidden actor can use valid credentials, approved tokens, or ordinary service flows while avoiding the thresholds that trigger common alerting rules.
Detection becomes harder when defenders lack identity-centric baselines such as who normally uses the account, when it is used, from where, and for what actions. NIST SP 800-63 Digital Identity Guidelines is relevant because strong authentication and session assurance reduce some abuse paths, but they do not by themselves reveal stealthy misuse after authentication has succeeded.
For that reason, stealthing should be treated as a visibility and correlation challenge: identify the account, process, or agent that is supposed to be there, then compare its observed behaviour against the expected operating pattern.
Security implications for trusted accounts and processes
When stealthing succeeds, the immediate consequence is not only unauthorized access, but also delayed detection, broader dwell time, and higher confidence for the intruder to explore, persist, or stage follow-on activity. In agentic and automated environments, that can also mean hidden tool use, disguised delegation, or covert control of business processes.
NIST Cybersecurity Framework 2.0 fits this term because stealthing sits at the intersection of protect, detect, and respond functions, where the organisation must both reduce the opportunity for covert use and recognise it quickly when it occurs.
Stealthing is therefore less about one compromised login and more about the failure of trust boundaries, monitoring depth, and post-authentication oversight. The more an environment depends on implicit trust in identities and automation, the more valuable stealth becomes to an attacker.
Risk and Threat Considerations
Stealthing creates a material exposure because it allows misuse of a trusted identity or process without the obvious signs that many security teams rely on. The result is longer persistence, weaker attribution, and a higher chance that malicious activity looks like routine operations until the impact is already visible.
Failure mechanism: The actor stays inside normal authentication and execution paths, then uses low-noise actions, legitimate tooling, or blended behaviour to avoid threshold-based alerts and simple anomaly checks.
Impact: Organisations can miss compromise for extended periods, allowing privilege abuse, lateral movement, data access, or covert control of automated workflows to continue with reduced resistance.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST SP 800-63 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | TA0003 — Persistence | Stealthing often supports covert persistence inside a trusted environment. |
| Recommendation — Map stealthy activity to persistence patterns and hunt for long-lived hidden access. | ||
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | Stealthing is easier when a trusted non-human identity has excessive access. |
| Recommendation — Reduce standing privilege so covert use of trusted identities has less reach. | ||
| NIST SP 800-63 | SP 800-63 — Digital Identity Guidelines | Strong authentication and session assurance shape how trusted access is established. |
| Recommendation — Use stronger identity assurance to limit easy abuse of trusted sessions. | ||
| NIST CSF 2.0 | DE.CM-01 — Anomalies and Events Are Detected | Stealthing directly challenges the ability to detect abnormal identity behaviour. |
| Recommendation — Baseline identity behaviour and tune detection for low-and-slow misuse. | ||
Practitioner Guidance
What to watch for: Treat stealthing as a correlation problem, not just an alerting problem. Identity, process, and workload telemetry should be reviewed together so that a valid session with unexpected behaviour does not disappear into normal activity.
Governance implication: Owners of trusted accounts, service identities, and automated processes should define what “normal” means for each high-value identity and be able to explain why its actions are expected. If no one can describe that boundary, the environment is already easier to hide in.