Identity-based attacks are outpacing human and machine controls

At a glance

What this is: This is Akeyless’s discussion of why identity-based attacks are rising and how secrets sprawl, machine identity growth, and short-lived credentials shape the control problem.

Why it matters: It matters because IAM, PAM, and NHI teams have to govern both human and machine access paths when attackers increasingly move through identity rather than perimeter controls.

By the numbers:

• 45 times more machine identities than human ones raises the stakes for every inventory, rotation, and offboarding decision.

👉 Read Akeyless’s discussion of identity-based attacks, machine identities, and secrets sprawl

Context

Identity-based attack paths now matter because attackers can reach data and systems by compromising credentials, tokens, certificates, and privileged accounts instead of breaking through a perimeter. In this article, the primary identity security problem is the overlap between human identity controls and machine identity sprawl, where secrets and admin-level access live longer than they should.

The article also points to a familiar governance failure: if a credential remains valid for 90 days or more, the attacker’s operating window is far larger than most teams assume. That makes secrets rotation, inventory, and lifecycle control central to both IAM and NHI programmes, not just a DevOps hygiene issue.

The starting point described here is typical of modern enterprise environments, not exceptional.

Key questions

Q: Why do long-lived machine credentials increase cloud security risk?

A: Long-lived credentials increase risk because compromise stays useful for longer and is harder to detect in time. If an API key, token, or service account remains valid across environments, the attacker can reuse it after the original leak. Short-lived access and automatic rotation reduce that persistence and make abuse less durable.

Q: Why do machine identities complicate traditional PAM programmes?

A: Machine identities complicate traditional PAM because they need access patterns that are automated, frequent, and often cross-cloud. If those workflows still rely on copied secrets or manual session handling, governance becomes a secrets lifecycle problem rather than a privilege problem. Native workload identity and ephemeral credentials are the controls that align better with that reality.

Q: What breaks when secrets are not rotated frequently enough?

A: The attacker’s dwell time expands. A stolen API key or SSH credential can remain usable for days or months, giving adversaries time to move laterally, access cloud resources, and avoid detection. Rotation only works if it is frequent enough to outpace realistic attacker use.

Q: Who should be accountable for machine identity offboarding?

A: Accountability should sit with the system or application owner, with identity operations enforcing the control. If no one owns retirement, service accounts and keys outlive the process that created them and continue to expand the attack surface long after their use case ends.

Technical breakdown

Why identity-based attacks displace perimeter-first security

Identity-based attacks work because cloud and remote-work environments make access decisions the real control plane. Once an attacker has valid credentials or a trusted token, they can often move through services, SaaS, and infrastructure without triggering the same alarms as malware-driven attacks. The article links this shift to the fact that both humans and machines now authenticate into the same operational fabric. That means the security problem is not just user login, but the entire chain of credential issuance, use, and revocation.

Practical implication: treat identity telemetry as a primary detection source, not a side signal.

How secrets sprawl creates long-lived attack windows

Secrets sprawl happens when API keys, SSH credentials, and other sensitive credentials are distributed across pipelines, code, and runtime systems without consistent governance. The article’s key point is that long validity periods, such as 90 days or more, give attackers ample time to use stolen secrets quietly. Ephemeral credentials and faster rotation reduce exposure by shrinking the useful life of any compromised secret. In practice, the problem is not only where secrets are stored, but how long they remain valid and how widely they are reused.

Practical implication: shorten credential lifetime and tie rotation to actual workload and developer workflows.

Why machine identity scale changes the governance model

Machine identities now outnumber human identities in many enterprises, which changes the governance problem from occasional privileged access review to continuous machine identity lifecycle management. Jenkins jobs, service integrations, certificates, and automation accounts can hold admin-level access and create lateral movement paths if they are compromised. Traditional PAM patterns were built for bounded human sessions, not for thousands of machine credentials operating across containers, DevOps tooling, and cloud services. The result is a governance gap between what teams can enumerate and what attackers can actually abuse.

Practical implication: build inventory, ownership, and rotation discipline for every machine identity class.

Threat narrative

Attacker objective: The attacker wants persistent, low-friction access to cloud resources and data by abusing trusted identity artefacts rather than noisy exploit chains.

1. Entry occurs when attackers obtain exposed credentials, tokens, or phishing-derived access tied to either a human user or a machine identity.
2. Escalation follows when those identities have standing privilege, broad cloud access, or reused secrets that can be moved laterally across systems.
3. Impact is achieved through data theft, cloud resource abuse, or expanded footholds that remain viable because the credential life cycle was too long.

Breaches seen in the wild

• Sisense breach — unauthorized GitLab access led to exfiltration of access tokens, API keys and certificates.
• GitHub Dependabot Breach — GitHub Dependabot tokens stolen and abused to push malicious commits to repositories.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity security is no longer a human-only governance problem. The article is right to frame the shift from phishing users to stealing cloud resources, but the deeper point is that machine identities now sit on the same attack surface as people. That collapses older IAM assumptions about where trust begins and ends. Practitioners should read this as a call to govern identity by actor type, not by access channel.

Secrets validity windows are a governance decision, not a technical detail. The article’s 90-day example shows that long-lived credentials are effectively standing privilege for attackers. Once a secret persists beyond the moment of intended use, the security model has already weakened. The practitioner takeaway is that credential lifespan must be treated as a first-class risk variable in NHI governance.

45 times more machine identities than human ones means the control plane has shifted. When machine identity volume outpaces human identity volume by that margin, manual review and periodic cleanup stop being credible primary controls. The issue is not just scale but mismatch between legacy governance cadences and machine-speed operations. Practitioners should assume machine identity growth will outpace human-centric review models unless lifecycle ownership is explicit.

Traditional PAM is necessary but insufficient for dynamic machine environments. The article correctly notes that PAM was not designed for containers and infrastructure-as-code. That matters because privileged access in modern environments is often embedded in pipelines and service workflows rather than interactive sessions. Security teams should treat privileged machine access as a lifecycle and runtime problem, not a vault-only problem.

From our research:

• From our research: The average organisation believes more than 1 in 5 of their non-human identities are insufficiently secured, according to The 2024 ESG Report: Managing Non-Human Identities.
• Two-thirds of enterprises have endured a successful cyberattack resulting from compromised non-human identities, with a quarter encountering multiple attacks.
• For a broader breach lens, the 52 NHI Breaches Analysis shows how compromised machine access repeatedly turns into lateral movement and data exposure.

What this signals

Identity programmes should expect more security work to move from account review into continuous credential lifecycle management. The operational question is no longer whether access exists, but whether the organisation can prove who owns it, why it exists, and when it expires.

Trust window compression: when credentials are valid for longer than the business need, the attacker inherits the same window. That makes lifecycle governance the practical bridge between IAM, PAM, and NHI security.

For teams maturing their programmes, the next step is not another inventory spreadsheet. It is binding machine identity ownership to offboarding, rotation, and runtime monitoring so access does not outlive the workload.

For practitioners

• Inventory every machine identity class Map service accounts, API keys, certificates, CI/CD credentials, and workload identities to named owners, systems, and renewal dates. Use the inventory to find blind spots where credentials exist without a documented business purpose or offboarding path.
• Shorten credential validity windows Replace long-lived secrets with ephemeral credentials wherever workloads can support them, and set rotation intervals based on operational use rather than convenience. Prioritise identities that hold admin-level access or can reach multiple cloud resources.
• Separate developer convenience from production trust Prevent secrets from being embedded in source code, shared across environments, or reused across unrelated automation jobs. Enforce distinct production controls for pipelines, scripts, and runtime services so one compromised secret does not create organisation-wide access.
• Review privileged machine access as a lifecycle issue Run access reviews on machine identities with the same discipline used for human leavers, movers, and privileged roles. Offboard unused keys, retire stale certificates, and verify that every privileged automation path still has a current business owner.

Key takeaways

• Identity-based attacks now span both people and machines, which means IAM and NHI governance must be planned as one control problem.
• Long-lived credentials and machine identity sprawl widen the attacker’s usable window far more than most access models assume.
• The most effective response is lifecycle discipline: inventory, ownership, rotation, and offboarding for every privileged identity class.

Key terms

• Machine Identity: The digital identity of a machine, device, or workload — such as a server, container, or VM — used to authenticate it within a network. Sometimes used interchangeably with NHI, though NHI is the broader category.
• Secrets Sprawl: The uncontrolled proliferation of sensitive credentials — API keys, tokens, passwords, certificates — across codebases, cloud environments, CI/CD pipelines, and configuration files. In 2024, over 50 million leaked secrets were found on the dark web.
• Ephemeral Credentials: Ephemeral credentials are short-lived access artefacts issued for a limited task or session. They reduce the window for abuse, but they only improve security when paired with strong scope limits, telemetry, and automatic revocation at task completion.
• Identity Lifecycle Governance: Identity lifecycle governance is the set of processes that create, change, review, rotate, and revoke access across human and non-human identities. It matters because access risk usually increases when lifecycle events are slow, incomplete, or disconnected from the systems that rely on them.

What's in the full article

Akeyless's full post covers the operational detail this post intentionally leaves for the source:

• The fireside-chat context and full conversation flow between Akeyless and Ross Young
• Specific examples of how secrets sprawl emerges across DevOps and cloud workflows
• The vendor’s description of Distributed Fragments Cryptography and its operating model
• The closing advice on developer education, SaaS adoption, and lifecycle management

👉 Akeyless’s full post includes the conversation details, practical examples, and closing recommendations.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an identity programme, it is worth exploring.