Identity incidents now dominate cyberattacks, with NHIs in the blind spot

At a glance

What this is: This is a Lumos research summary showing that identity has become the dominant cyberattack entry point, while NHIs remain the least well governed part of the identity estate.

Why it matters: It matters because IAM teams now have to treat human users, service accounts and emerging agentic workflows as one governance problem, or attackers will keep moving through whichever layer is least visible.

By the numbers:

• 96% of organisations have experienced identity-related security incidents.
• 43.6% of organisations reported the use of stolen credentials.
• 48.1% of organisations experienced a Multi-Factor Authentication fatigue attack.
• Machine identities now outnumber human identities by as much as 20:1.

Context

Identity has become the primary access path in modern attacks because credentials, tokens, service accounts and human approvals are all being targeted in the same kill chain. In practice, that means the old split between human IAM, NHI controls and monitoring is no longer a workable operating model for enterprise defence.

Lumos's findings frame a familiar governance failure in sharper terms: organisations still think about access review, MFA, service account control and detection as separate programmes, while adversaries exploit them as one continuous identity surface. The result is permission creep, blind spots around machine identities, and slow detection of misuse while the attack is still live.

The article's central signal is that identity maturity is now less about adding another control and more about closing the gaps between existing controls. That is especially true where NHIs outnumber humans and where real-time decisioning, not annual review, determines whether an attacker can move laterally.

Key questions

Q: What breaks when identity controls are split across human, NHI and detection teams?

A: Attackers exploit the seams between ownership, review and telemetry. A stolen credential, abused service account or fatigued approver can all look separate in org charts while functioning as one access path in practice. The result is delayed containment, inconsistent privilege decisions and a larger blast radius than any single control team expects.

Q: Why do stolen credentials and MFA fatigue attacks keep working in mature environments?

A: They work because authentication success is often treated as the end of the control, not the beginning of identity oversight. Once an attacker has a valid session, excessive privilege, dormant access or weak monitoring determines how far they can go. The security issue is governance after login, not login alone.

Q: How can security teams tell whether NHI governance is working?

A: They should look for fewer orphaned accounts, shorter credential lifetimes, lower secret reuse and faster decommissioning when systems or projects end. If credentials still survive after business purpose has ended, the governance model is not controlling the lifecycle effectively.

Q: When should organisations prioritise identity attack surface visibility over more reviews?

A: They should prioritise visibility when reviews are repeatedly certifying stale state. If access changes faster than recertification can reflect it, more reviews add paperwork but not control. Continuous exposure visibility is the prerequisite for deciding which identities, paths, and privileges are actually worth certifying.

Technical breakdown

Why identity-based attacks succeed before perimeter defences react

Identity-based attacks work because access is already authenticated in many cases before the abuse begins. Stolen credentials, MFA fatigue and dormant accounts let attackers operate through legitimate-looking sessions, which means perimeter controls often see normal traffic rather than an intrusion. Once the session is trusted, escalation happens through permissions, not malware. In NHI-heavy environments, the same pattern applies to service accounts and tokens that are widely distributed, rarely observed and often reused across systems. The security problem is not only compromise. It is that access control and detection are frequently decoupled from the identity event that made compromise possible.

Practical implication: move detection and review closer to issuance, authentication and privilege change, not just to network or endpoint alerts.

Why machine identities create governance blind spots

Non-Human Identities are service accounts, API keys, tokens and certificates that act for systems rather than people. They become blind spots when ownership is unclear, lifecycle steps are missing, or privileges are granted once and never revisited. The Lumos data points to a classic NHI failure mode: machine identities can outnumber humans by a large margin, yet teams still govern them with weaker inventory, weaker review and weaker anomaly detection than human accounts. That creates permission creep, dormant access and service account abuse opportunities that look routine to defenders but are highly exploitable to attackers.

Practical implication: inventory every machine identity with an owner, purpose, scope and expiry so governance can follow the account through its full lifecycle.

Why real-time identity detection is now a control requirement

Real-time identity detection matters because attackers do not wait for periodic review cycles. If identity misuse is only discovered during audit, the organisation has already lost the window to stop lateral movement, privilege expansion or data access. That is why mean time to detect and mean time to provision are becoming operational identity controls, not just SOC metrics. As identity counts rise and automation increases, the speed of identity decisions becomes a security boundary. This is where agentic AI enters the picture: teams are looking for faster triage and access decisions, but the governance standard still has to prove why the system acted and whether that action was appropriate.

Practical implication: define measurable identity detection and provisioning targets, then tie them to escalation paths for suspicious privilege changes or service account abuse.

Threat narrative

Attacker objective: The attacker wants to use legitimate-looking identity paths to move laterally, expand access and reach data or systems without triggering immediate containment.

1. Entry begins with stolen credentials, MFA fatigue or abuse of an already trusted account, allowing the attacker to enter through identity rather than exploitation of a software flaw.
2. Credential access then expands into permission use, where dormant access, service account abuse or excessive privileges give the attacker a broader operational footprint.
3. Escalation occurs through lateral movement inside the environment because identity telemetry is too weak to distinguish legitimate access from misuse in real time.
4. Impact follows when the attacker reaches additional systems or data while defenders are still operating on delayed review and detection cycles.

Breaches seen in the wild

• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
• CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity has become the organising layer of enterprise attack paths: The article confirms that adversaries now treat identity as the shortest route into cloud, SaaS and internal systems. That changes the security conversation from perimeter defence to identity control consistency across human accounts, service accounts and emerging automated actors. For practitioners, the lesson is that fragmented ownership of identity controls creates exploitable seams.

NHIs are the least visible part of the identity estate and therefore the highest-leverage governance gap: When machine identities outnumber human users, small control weaknesses scale quickly into systemic exposure. The article's service account and dormant access findings show that the problem is not just quantity but lifecycle weakness, especially where ownership, review cadence and privilege scope are unclear. Practitioners need to treat NHI lifecycle governance as a core control plane, not an add-on.

Permission creep is now an identity risk amplifier, not a housekeeping issue: Excess access compounds the impact of stolen credentials, MFA fatigue and service account misuse because attackers inherit accumulated privilege rather than having to build it. That makes least privilege, entitlement review and privilege reduction part of attack containment, not just compliance. The practical conclusion is that excess access is a direct contributor to breach blast radius.

Real-time identity decisioning is becoming the point where governance either holds or fails: Annual or quarterly review cycles cannot stop attacks that are completed inside a single session or a short abuse window. The more identities, privileges and automation a programme contains, the more it needs near-real-time telemetry to keep decisions aligned with actual use. The field should now measure identity security by how quickly it can detect misuse, not by how many accounts it has reviewed.

Identity control stacks must converge across human IAM, NHI governance and automated decisioning: The report's findings on AI adoption, auditability concerns and narrow-use deployment show why organisations are still cautious about agentic approaches. The right response is not to isolate AI from identity governance, but to apply the same accountability, auditability and entitlement discipline across every identity class. Practitioners should plan for a single governance model with differentiated controls by actor type.

From our research library:

• 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments, according to the 2026 Infrastructure Identity Survey.
• 88% of organisations have embedded AI agents in their workflows, according to KPMG's 2026 report.
• Read next: Agentic AI Security Guide

What this signals

Identity governance is shifting from periodic certification to continuous exposure management: When credentials, tokens, service accounts and human approvals all sit on the same attack path, the old cadence of quarterly review is no longer sufficient. Practitioners need a control model that can surface risky privilege use as it happens, not after the next attestation cycle.

Machine identity density is the hidden scaling problem: The more NHIs outnumber human accounts, the more every gap in ownership, review and telemetry compounds across the estate. That is why a programme can appear mature on paper while still leaving service accounts and dormant access as the easiest route for attackers.

AI-assisted identity operations will only help if auditability is explicit: Automated review and triage can reduce manual load, but only when teams can explain why a decision was made and who approved the operating logic. Without that proof, automation becomes another layer of opacity on top of an already crowded identity stack.

For practitioners

• Consolidate identity ownership into one control model Map human users, service accounts, tokens and future AI-driven identities into a single inventory with named owners, business purpose, privilege scope and review cadence so control gaps do not sit between teams.
• Prioritise dormant access and service account cleanup Review dormant accounts, unused entitlements and service account permissions first, because the article shows these are the easiest places for attackers to find unmonitored access paths.
• Measure identity misuse in real time Set operational targets for mean time to detect and mean time to provision so suspicious privilege use is visible while the session is still active, not after audit.
• Apply privilege reduction to high-blast-radius accounts Reduce excess access on accounts that can reach crown-jewel systems, since stolen credentials or MFA fatigue become much harder to exploit when the account does not carry inherited privilege.
• Define auditability for automated identity decisions Require clear decision logs, rationale and exception handling for AI-assisted access reviews and triage so automation can be governed instead of merely trusted.

Key takeaways

• Identity incidents increasingly succeed because attackers can move through legitimate identity paths rather than needing novel exploits.
• The weakest areas in the article's data are machine identities, dormant access and real-time misuse detection, and those weaknesses scale together.
• The most effective response is a unified identity governance model that reduces excess privilege, improves ownership and shortens the time between misuse and detection.

Key terms

• Identity-related security incident: An incident in which identity is the main path attackers use to gain access, expand privilege or move laterally. In practice, this includes stolen credentials, MFA fatigue and abused accounts, and it often succeeds because authentication and post-login governance are treated as separate problems.
• Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
• Permission Creep: The gradual accumulation of access beyond what a user or workload currently needs. It usually happens because initial approvals are never fully removed or recertified. In practice, permission creep is a lifecycle failure that turns temporary exception access into de facto standing privilege.
• MFA Fatigue Attack: An MFA fatigue attack is a social engineering technique that bombards a user with repeated authentication prompts until they approve one out of annoyance, confusion, or urgency. The attacker usually starts with stolen credentials, then uses the approval flow itself to obtain access.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.