Identity-based attacks are outpacing human and machine controls

At a glance

What this is: Akeyless summarises a fireside chat arguing that identity-based attacks now target both people and machine identities, with long-lived secrets and admin-level machine access creating the easiest paths for attackers.

Why it matters: This matters because IAM, PAM and NHI programmes now have to govern cloud-era machine access, secrets sprawl and credential lifetime as one attack surface rather than separate problems.

👉 Read Akeyless' analysis of identity-based attacks across human and machine identities

Context

Identity-based attacks are attacks that succeed by abusing identities, credentials and trust relationships rather than by exploiting only software bugs. In this article, Akeyless argues that the problem spans both human and machine identities, with cloud migration and DevOps automation expanding the number of credentials that can be targeted.

The governance gap is that many IAM and PAM programmes still assume credentials are relatively stable and can be reviewed, rotated or revoked on a comfortable schedule. That assumption weakens when developers, cloud resources and service accounts all hold privileged access across fast-changing environments.

Ross Young's commentary is framed around operational reality, not theory: if secrets live too long, are copied too widely or are left unrotated, attackers will work from the easiest identity foothold they can find. That makes identity lifecycle control a frontline security issue, not a back-office hygiene task.

Key questions

Q: What breaks when organisations keep using standing privileges for machine identities?

A: Standing privilege turns NHIs into persistent trust anchors. If the credential is embedded in code, reused across environments, or left valid after the workload changes, the access outlives the business purpose. That creates a durable attack path and makes it difficult to prove that the identity is still needed.

Q: Why do long-lived secrets increase breach risk in cloud and fintech environments?

A: Long-lived secrets extend the time an attacker can reuse stolen access, which increases the chance of data theft, lateral movement, and compliance failure. In cloud and fintech environments, the problem is compounded by multiple replicas, integrations, and shared tooling, which makes revocation slower and harder to prove.

Q: How can teams reduce blast radius for remote and machine access?

A: Teams can reduce blast radius by combining JIT access, PAM, and strong identity inventory. The goal is to ensure privileged access is approved for a short duration, tied to a named owner, and revoked automatically when the task ends.

Q: What is the difference between machine identity security and human IAM?

A: Human IAM is built around interactive authentication, user review, and role assignment. Machine identity security is about credentials that run in code, pipelines, and services, so the priority is inventory, rotation, and lifecycle control. Machines can scale faster than human governance processes, which is why discovery and expiry matter more than login experience.

Technical breakdown

Why secrets sprawl turns identity into the attack surface

Secrets sprawl is the distribution of API keys, SSH credentials, certificates and tokens across many systems, pipelines and workloads. In DevOps-heavy environments, a single person can administer thousands of machines, which multiplies the number of places where credentials can be copied, cached or embedded. The security problem is not only exposure at creation time. It is persistence: once a secret exists in multiple systems, the attacker only needs one usable copy to turn identity into a control-plane problem. That is why rotation cadence and visibility into where secrets live matter as much as the strength of the initial credential.

Practical implication: inventory where secrets are stored, copied and consumed before tightening rotation or revocation policy.

How long-lived machine access changes the blast radius

Machine identities become dangerous when they carry admin-level access or broad lateral movement potential. A service account or build system with persistent privilege can be used to move from one workload to many, especially in cloud environments where trust is distributed across tools, pipelines and APIs. The article highlights a key risk window: credentials valid for 90 days or longer give attackers time to operate without immediate interruption. Ephemeral credentials reduce that window by making stolen access expire before it can be reused at scale.

Practical implication: treat credential lifetime as a blast-radius control, not just a convenience setting.

Why traditional PAM struggles in dynamic cloud and DevOps estates

Privileged access management was designed around more static administrative access patterns. Containers, infrastructure as code and automated deployment pipelines change privileges too quickly for legacy assumptions about session length, review cadence and manual approval to hold cleanly. When access is created and consumed by software rather than by a person at a workstation, governance has to account for system-to-system trust, not only human elevation. The operational issue is not that PAM is obsolete, but that it cannot be the only control plane for dynamic machine access.

Practical implication: extend PAM governance to workload and pipeline identities instead of treating it as a human-only control.

Threat narrative

Attacker objective: The attacker wants durable access through trusted identities so they can move laterally, steal data and avoid early detection.

1. Entry begins with phishing, developer compromise or abuse of cloud-facing credentials that provide a foothold into the identity layer.
2. Credential harvesting follows when API keys, SSH credentials or admin-level machine access are discovered, copied or reused across systems.
3. Escalation occurs when the attacker uses long-lived or overbroad machine privileges to move laterally through cloud resources and DevOps workflows.
4. Impact is achieved when data is exfiltrated or cloud resources are abused before the stolen identities are rotated or revoked.

Breaches seen in the wild

• Microsoft Midnight Blizzard breach: Midnight Blizzard (APT29) exploited legacy test account without MFA to breach Microsoft.
• United Nations breach 2021: Sakura Samurai used exposed Git credentials to reach 100,000+ UNEP staff records, then reported the flaw through the UN disclosure programme.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity governance now fails first at lifetime, not login. The core problem in this article is not simply weak authentication. It is that many identity programmes still assume credentials will exist long enough to be reviewed, rotated or certified on a human schedule. When cloud access and DevOps automation compress access into short operational bursts, the governance model falls behind the attack model.

Secrets sprawl is a governance problem, not a storage problem. The article shows that API keys, SSH credentials and certificates are spreading because modern delivery pipelines replicate trust faster than security teams can enumerate it. That makes lifecycle control the decisive issue. Practitioners need to treat secret inventory, rotation and revocation as operational control points, not as back-end administration.

Standing privilege in machine identities is the modern lateral-movement substrate. Admin-level Jenkins-style access is not a niche case. It is a pattern created when automation is granted broad trust to keep delivery moving. Once those identities can reach many systems, compromise of one machine account becomes an organisational access problem, which is why NHI governance now sits alongside PAM and cloud security.

Ephemeral credential trust debt: the article points to a growing mismatch between fast-moving machine access and the slower controls built for people. Credentials that persist for days or months accumulate trust debt because they outlive the operational reason they were issued. The practitioner conclusion is straightforward: the shorter the credential lifetime, the smaller the recoverable attack window.

Machine identity governance is becoming the organising layer for cloud-era access. Human IAM, PAM and secrets management are converging on the same question: who or what can be trusted to act inside production, for how long, and under what lifecycle rules. The programmes that answer that question with inventory, short-lived access and enforced rotation will be the ones that can actually absorb modern identity-based attack pressure.

From our research library:

• NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
• Read next: Guide to NHI Rotation Challenges

What this signals

Machine identity governance is now a lifecycle discipline. Identity programmes that still separate human IAM, PAM and secrets management are missing the operational reality described here: cloud and DevOps access patterns are creating machine identities faster than teams can certify them. The practical shift is from periodic review to continuous issuance control, continuous rotation and continuous revocation.

The next governance question is not whether a secret can be stored securely, but whether it should exist long enough to be stolen. That is where short-lived credentials, owner mapping and workload identity become the core controls, especially when admin-level automation touches production.

Ephemeral access changes the security economics. When a credential expires before an attacker can reuse it, the value of theft drops sharply. That is why identity programmes should treat credential lifetime and blast radius as linked design variables rather than separate hygiene tasks.

For practitioners

• Inventory machine identities and their privilege scopes Map service accounts, CI/CD credentials, API keys and certificates to the systems they can reach, then remove identities that cannot be tied to an owner and purpose.
• Shorten credential lifetime aggressively Replace 90-day or longer credential windows with ephemeral or daily rotation patterns where operationally possible, especially for high-value cloud and DevOps paths.
• Remove secrets from source code and pipeline variables Block hardcoded secrets in repositories, build logs and deployment templates, then shift to controlled issuance and retrieval at runtime.
• Extend PAM governance to workload access Apply approval, traceability and revocation rules to machine accounts that hold admin-level access, including container and infrastructure-as-code workflows.
• Prioritise lateral-movement paths in cloud identities Focus first on the identities that can reach many workloads, cloud resources or production automation paths, because those create the largest blast radius when compromised.

Key takeaways

• Identity-based attacks succeed when attackers can abuse trusted identities instead of breaking through the perimeter first.
• The article's key warning is that long-lived secrets and broad machine privileges leave attackers enough time to move laterally across cloud environments.
• The practical control point is lifecycle discipline: inventory identities, shorten credential windows and remove standing access where machines do the work.

Key terms

• Machine Identity: The digital identity of a machine, device, or workload, such as a server, container, or VM, used to authenticate it within a network. Sometimes used interchangeably with NHI, though NHI is the broader category.
• Secrets Sprawl: The uncontrolled proliferation of sensitive credentials, API keys, tokens, passwords, certificates, across codebases, cloud environments, CI/CD pipelines, and configuration files. In 2024, over 50 million leaked secrets were found on the dark web.
• Ephemeral Credentials: Ephemeral credentials are short-lived access artefacts issued for a limited task or session. They reduce the window for abuse, but they only improve security when paired with strong scope limits, telemetry, and automatic revocation at task completion.
• Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.

What's in the full article

Akeyless' full post covers the operational detail this post intentionally leaves for the source:

• Ross Young's examples of how phishing, developer compromise and cloud access evolved as attack paths
• Practical guidance on moving from 90-day credentials to ephemeral access and daily rotation
• The discussion of how PAM assumptions break in containers and infrastructure-as-code workflows
• Akeyless' summary of zero-knowledge secrets handling and SaaS operating trade-offs

👉 The full Akeyless post covers the fireside chat, machine identity risk and mitigation strategies in more detail.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.