TL;DR: Legacy Active Directory, service accounts, and insecure authentication protocols remain a primary path for compromised credentials, lateral movement, and ransomware because most enterprises still lack full visibility into service accounts, according to Silverfort and NHIMG research. Security-first authentication and inline blast-radius controls matter because residual identity risk does not disappear while migration projects remain incomplete.
At a glance
What this is: This is an argument that legacy identity infrastructure remains a live security problem, with service-account invisibility and insecure authentication keeping attack paths open.
Why it matters: It matters because IAM teams cannot treat legacy estates as temporary exceptions; they need controls that reduce exposure now across NHI and human access paths.
By the numbers:
- 94.3% of organizations don’t have full visibility into their service accounts, let alone understand their activity.
Context
Legacy identity estates create a governance gap when critical systems remain in production long after security programmes assume they can be modernised. Active Directory, service accounts, and older authentication protocols still carry operational load, but they often sit outside the control patterns IAM teams apply to newer environments.
The core issue is not whether migration will happen, but whether risk can be reduced before migration completes. In identity terms, the answer depends on whether teams can govern non-human identities and legacy authentication paths in place, without breaking business continuity or waiting for app-by-app replacement.
That makes this a NHI and IAM governance problem at the same time: unmanaged service accounts, outdated protocols, and residual privilege all extend the attack surface until they are actively contained.
Key questions
Q: Where does legacy identity risk fail when service accounts are not fully visible?
A: It fails at governance, because unseen service accounts cannot be owned, reviewed, or constrained with confidence. In practice, that means privileged access controls and migration plans are both operating on incomplete information. The first response is to establish inventory and accountability before treating the estate as manageable.
Q: Why do service accounts and legacy authentication paths increase ransomware risk?
A: Because attackers prefer identity paths that already have trust, reach, and persistence. A stolen service account or weak legacy protocol can provide access without triggering the same controls used for modern user journeys, which widens the blast radius and shortens the time from entry to disruption.
Q: What are the signs that residual identity controls are not actually reducing exposure?
A: The clearest signs are long onboarding cycles, unclear account ownership, continued use of insecure protocols, and controls that only exist after a migration project finishes. If an organisation still cannot explain what each service account does, its exposure is still unmanaged, even if PAM has been added.
Q: Should teams prioritise migration or containment when legacy systems still run the business?
A: Containment first, migration in parallel. If the business depends on fragile legacy systems, security teams need controls that reduce identity blast radius now rather than treating modernisation as the only acceptable path. Migration is the destination, but containment is what makes the journey safe enough to continue.
Technical breakdown
Why legacy authentication stays exploitable
Legacy authentication persists because many critical systems still depend on protocols and account patterns that were designed for continuity, not for hostile environments. NTLM, shared service accounts, and application-specific credentials reduce operational friction, but they also create broad trust relationships that attackers can abuse once a credential is stolen. In practice, the security problem is not simply that older systems are old. It is that their authentication model often assumes the network or account holder is already trusted, which is incompatible with modern identity threat models. That gap is why identity-first enforcement at the point of authentication matters more than retrospective cleanup.
Practical implication: place stronger verification and protocol constraints directly at authentication time, especially where legacy systems cannot be rebuilt quickly.
How service-account visibility affects blast radius
Service accounts are high-risk because they are often numerous, under-documented, and used by processes that no one reviews regularly. When organisations cannot inventory them or understand activity, they cannot reliably distinguish legitimate machine behaviour from abuse. That creates a visibility problem and a governance problem: if you do not know what the account should do, you cannot confidently limit what it can do. For identity teams, this is why service-account oversight is not a housekeeping task. It is a prerequisite for containing lateral movement, privilege abuse, and silent operational compromise.
Practical implication: establish authoritative service-account visibility before relying on privileged access controls or migration timelines.
Why security-first authentication changes the control point
A security-first model moves the control point from downstream detection to the moment access is requested. Instead of assuming authentication should maximise convenience first and security later, the model uses inline policy to block or challenge risky access before a session is established. That matters in legacy estates because you can often constrain access without changing the underlying system. The shift is structural: the environment becomes the enforcement layer, not just the application or the user endpoint. This is how organisations reduce identity risk while they continue operating legacy workloads.
Practical implication: enforce context-aware controls at the authentication layer so legacy systems inherit policy without direct modification.
Threat narrative
Attacker objective: The attacker aims to turn one legacy identity foothold into broader environment access, then monetise it through disruption, encryption, or further compromise.
- Entry begins with compromised credentials or abuse of an unmanaged service account that already has standing access to a legacy system.
- Escalation follows when insecure authentication protocols or weak trust boundaries let the attacker reuse that access across adjacent systems.
- Impact occurs through lateral movement and ransomware deployment, often before the organisation has finished migrating the exposed identity estate.
Breaches seen in the wild
- Cisco Active Directory credentials leak 2025: Kraken leaked Cisco Active Directory hashes, including service and krbtgt accounts; Cisco says they came from its 2022 breach, not a new one.
- Salt Typhoon telecom intrusions 2025: Salt Typhoon breached US telecoms mainly with stolen logins, then harvested SNMP strings and TACACS/RADIUS keys to spread and persist for years.
Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Legacy identity risk is a containment problem, not a migration problem. The governing issue is that critical access paths remain live while modernisation projects crawl forward. That means the security outcome depends on what can be enforced in place, not on how quickly systems can be replaced. Practitioners should treat residual identity exposure as an operational control issue, not a future-state architecture discussion.
Service-account invisibility is the real governance defect. When organisations cannot see 94.3% of their service-account estate clearly, they cannot credibly claim to govern it. This is not just an inventory gap. It is a failure of accountability, lifecycle oversight, and privilege assurance across the non-human layer. Practitioners need to regard visibility as the minimum condition for identity control, not an audit artefact.
Identity blast radius becomes the decisive control variable in legacy environments. If systems cannot be modernised immediately, then the practical question is how far stolen credentials can move. Blocking out-of-pattern access, restricting non-human accounts to repeated business use, and denying legacy protocol abuse all narrow the blast radius. The implication is that security teams should measure control value by containment, not by completeness of migration.
Security-first authentication is the only defensible bridge strategy. Legacy environments need a control plane that can enforce policy without breaking fragile systems. That means treating authentication as the front line for NHI and human access alike, with enough inline authority to challenge, block, or constrain risky sessions. The practitioner conclusion is straightforward: modernisation remains necessary, but security cannot wait for it.
From our research library:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- Read next: Guide to NHI Rotation Challenges
What this signals
Identity blast radius is the right lens for legacy estates. When authentication must still support old systems, the question is not whether those systems are imperfect. The question is how much damage a stolen credential can do before the session is challenged or blocked. That makes inline enforcement and scope restriction more valuable than broad promises of eventual migration.
Service-account visibility is a governance baseline, not an optimisation task. If most organisations still lack full visibility into service accounts, then many IAM programmes are still operating without a reliable non-human inventory. That undermines ownership, recertification, and exception handling across the estate, especially where legacy applications depend on accounts that no one reviews routinely.
Security-first authentication changes the sequencing of modernisation. Teams can keep legacy systems running while they reduce exposure by constraining where, when, and how identities authenticate. The practical shift is to treat authentication policy as the interim control plane, not as a final-state design choice.
For practitioners
- Map every legacy service account to an owner and purpose Build a current inventory of service accounts, Active Directory-linked identities, and application-specific credentials, then assign accountable owners for each one. Focus first on accounts that support business-critical processes but currently lack clear lifecycle oversight.
- Enforce inline challenge rules at authentication Require additional verification for access from suspicious locations, unmanaged endpoints, or unusual session patterns, even when the target system itself cannot be changed. Use the authentication layer as the enforcement point for risky requests.
- Restrict non-human accounts to known business use Constrain service accounts to the systems, tasks, and time windows they repeatedly need, and block out-of-pattern usage that would expand lateral-movement options after compromise. This is the fastest way to shrink blast radius without rewriting legacy applications.
- Block insecure legacy protocols where they are no longer required Identify where NTLM and similar protocols remain in use only for convenience, then remove or confine them to the smallest possible set of dependencies. Legacy protocol exposure should be treated as an identity-risk reduction project, not just a networking issue.
- Separate migration progress from risk reduction Track modernisation as a strategic programme, but do not let it become the only measure of security improvement. Report on containment controls, access scope, and verified ownership so leadership can see risk reduction before each application is replaced.
Key takeaways
- Legacy identity estates remain active attack surfaces because service accounts and insecure protocols still carry production access.
- The biggest governance weakness is incomplete visibility into service accounts, which limits ownership, review, and containment.
- IAM teams should reduce identity blast radius in place while modernisation continues, rather than waiting for migration to deliver security.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | Legacy service accounts often carry broader rights than their day-to-day tasks require. |
| NHI-07 — Long-Lived Secrets | The article centres on enduring credentials and protocols that remain exploitable for years. | |
| NHI-04 — Insecure Authentication | NTLM and other outdated protocols are a core part of the risk described here. | |
| Recommendation — Restrict legacy service accounts to the minimum access needed for repeated business operations. Review legacy authenticator lifetimes and retire long-lived secrets wherever possible. Block or constrain insecure authentication methods at the point of access. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Authenticator lifecycle and rotation are central to reducing residual identity exposure. |
| Recommendation — Apply authenticator management controls to govern legacy credentials and retire weak methods. | ||
| CIS Controls v8 | CIS-5 — Account Management | The article highlights unmanaged service accounts and incomplete account oversight. |
| Recommendation — Centralise account management so every service account has an owner, purpose, and review cycle. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | The article ties legacy identity compromise to credential abuse and movement across systems. |
| Recommendation — Map legacy identity exposure to credential access and lateral movement to prioritise containment. | ||
Key terms
- Residual Identity Risk: Residual identity risk is the exposure that remains in legacy accounts, protocols, and systems after a programme has started modernising. It matters because business-critical identities often outlive the controls originally designed to protect them, leaving a persistent gap between operational dependency and security governance.
- Service account visibility: The ability to discover, attribute, and review non-human accounts across an environment. For NHI governance, visibility includes owner mapping, permission history, and lifecycle state so that access is not left to drift in legacy or private systems.
- Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
- Security-First Authentication: Security-first authentication is an approach that treats access decisions as a control point, not just a convenience layer. It applies stronger verification and policy enforcement at login so legacy systems inherit modern protection without requiring invasive redesign or risky replacement projects.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 24, 2026.
Updated on October 6, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org