Service account protection now sits at the centre of breach reduction

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Semperis's blog post: Service accounts remain a high-impact breach path, with the Merck NotPetya case showing how a patching account became an initial entry point.

Why it matters: It matters because service accounts sit inside core business processes, so IAM, PAM, and NHI teams need inventory, privilege control, and lifecycle governance that can handle stale identities and hybrid AD exposure.

By the numbers:

• The 2017 NotPetya attack on Merck caused damages exceeding $1.4 billion.

Context

Service accounts are non-human identities that support background tasks, integrations, and administrative automation. They often persist far longer than the applications they serve, which turns them into durable breach paths when passwords, privileges, and ownership are not actively governed.

The article argues that this risk is not theoretical. Semperis ties service account exposure to real breach history, then frames discovery, monitoring, rollback, and attack-path analysis as the operational problem identity teams must solve across Active Directory and Entra ID.

Key questions

Q: What breaks when service accounts keep long-lived standing access?

A: Long-lived standing access turns one intercepted credential into a reusable credential for lateral movement and persistence. If the token or account is not scoped tightly, the attacker can impersonate the service for as long as it remains valid. That makes revocation speed and privilege scope the decisive controls.

Q: Why do compromised service accounts create such a high-risk path for identity-based attacks?

A: Compromised service accounts are dangerous because they often carry elevated access and are trusted by systems that do not challenge their actions. Once an attacker steals those credentials, they can move through support systems, extract session material, and pivot into downstream applications. The risk grows when the account is used in normal workflows that blend with legitimate activity.

Q: How do security teams know if service account governance is actually working?

A: Governance is working when every service account has an owner, a workload, a retirement condition, and an auditable rotation path. Teams should also see reduced stale access, fewer unknown accounts, and fewer secrets stored outside managed controls. If the organisation cannot explain why an account still exists, governance is not yet effective.

Q: Should organisations treat service account risk as part of AD hardening or NHI governance?

A: They should treat it as both, because service accounts are NHI assets that often determine the security of Active Directory itself. AD hardening controls the attack surface, while NHI governance controls ownership, lifecycle, and privilege across the accounts that keep core systems running.

Technical breakdown

Why service accounts become breach entry points

Service accounts are attractive because they often hold standing access to critical systems, use static credentials, and are tied to operational processes that teams are reluctant to interrupt. When ownership is unclear, retirement is incomplete, or privilege was granted years ago and never revisited, the account becomes both hard to see and easy to abuse. In hybrid Active Directory environments, that problem compounds because the same identity can touch multiple domains and administrative planes. The result is not just excess access, but an account that attackers can exploit as a stable foothold.

Practical implication: Treat service-account inventory and ownership as a live control, not a periodic cleanup task.

How automated rollback changes response speed

The article’s response model centres on machine-speed intervention. Rather than waiting for analysts to investigate alerts, automated rules can detect anomalous or malicious changes and immediately roll back modifications or disable the account before the attack chain progresses. This matters because service-account abuse often unfolds too quickly for manual containment, especially when the account sits inside identity infrastructure or operational tooling. Automated response therefore acts as a containment layer, not a replacement for investigation, and it reduces the window in which a compromised account can be weaponised.

Practical implication: Pre-authorise containment actions for high-risk service accounts so response can occur before damage spreads.

Why attack path analysis matters in Active Directory

Attack path analysis maps how objects, permissions, configurations, and relationships combine into exploitable routes through Active Directory. For service accounts, the issue is rarely a single bad setting. It is the path created by inherited permissions, over-privilege, stale objects, and cross-system dependencies. By surfacing those routes, teams can see which accounts provide privilege escalation opportunities and which combinations of access are most likely to lead to domain compromise. That is especially relevant in hybrid environments where AD and Entra ID exposure overlap.

Practical implication: Use attack-path analysis to prioritise the service accounts that create the shortest route to AD compromise.

Threat narrative

Attacker objective: The attacker objective is to leverage a trusted machine account to gain initial access and expand disruption across the enterprise.

1. Entry occurred when attackers compromised a service account used for OS patching, giving them a legitimate foothold into Merck’s environment.
2. Escalation followed because service-account access provided a route into systems critical to business operations rather than a narrow task-only boundary.
3. Impact expanded into a destructive outbreak that helped drive losses exceeding $1.4 billion and demonstrated how machine-account compromise can scale far beyond the original account.
4. The broader lesson is that service-account abuse turns routine administrative access into a durable breach path when privileges are standing and ownership is unclear.

Breaches seen in the wild

• Dropbox Sign breach 2024: A compromised back-end service account gave attackers Dropbox Sign customer data, including API keys, OAuth tokens and MFA information.
• Kubeflow cryptomining attacks 2020: Exposed Kubeflow dashboards and a notebook's mounted Kubernetes service account let attackers run cryptominers on tens of ML clusters.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Service account governance fails when identity is treated as a static object instead of an operational dependency. These accounts are created to keep processes running, but they frequently outlive the systems and people that originally owned them. That is why stale service-account inventory is not an administrative nuisance, it is a governance failure that widens breach exposure across the identity estate.

Standing privilege is the real breach multiplier in service-account environments. Static passwords matter, but excessive privilege is what turns one compromised account into a route through core business systems. The control problem is not only credential protection, it is shrinking the blast radius of identities that were never meant to carry broad authority.

Attack path analysis has become a first-class identity control for Active Directory. In complex AD environments, the question is no longer whether an account exists, but whether it creates a reachable path to privilege escalation or domain compromise. The practical implication is that service-account security must be managed as graph risk, not as isolated account hygiene.

Hybrid AD and Entra ID security exposes the limits of log-only detection. Fast-changing identity state can move faster than human review or SIEM correlation, especially when an attacker abuses a trusted account already inside the estate. That makes rollback-capable response and continuous validation necessary parts of breach reduction, not optional hardening.

Identity blast radius is the named concept this article sharpens. A single service account can touch patching, administration, and downstream business processes, so compromise is measured by the reach of the account rather than by the account itself. Practitioners should evaluate every privileged machine identity by the damage it can spread, not by its label.

From our research library:

• 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to the Ultimate Guide to NHIs.
• Read next: Service Account Security Guide

What this signals

Identity blast radius: service-account risk is best measured by how far a compromised account can reach across directory services, patching workflows, and downstream administration. Teams that still manage these accounts as isolated technical artifacts will keep missing the cumulative damage they can enable.

The operational shift is toward continuous validation rather than periodic review. If an account can be forgotten for years, it can also be left with privilege that no longer matches the workload, so ownership and lifecycle controls become as important as authentication itself.

For practitioners

• Map every service account to an owner and purpose Build an authoritative inventory that ties each service account to a business process, technical owner, and retirement trigger. Remove accounts that no longer map to an active workload or administrative need.
• Reduce standing privilege on patching and admin accounts Review service accounts used for infrastructure maintenance, deployment, and directory administration, then strip permissions that are not required for the task they perform.
• Automate rollback for anomalous account behaviour Configure response rules so that suspicious changes, unusual logons, or unexpected privilege use can disable the account or revert the change without waiting for manual intervention.
• Prioritise attack paths that reach directory control Use attack-path analysis to find service accounts that create escalation routes into Active Directory and Entra ID, then focus remediation on the shortest routes to compromise.

Key takeaways

• Service accounts remain one of the most exploitable identity types because they often combine static credentials, broad privileges, and poor ownership.
• The Merck NotPetya case shows how a single compromised patching account can contribute to very large enterprise losses.
• The practical control gap is not only credential hygiene, but continuous discovery, privilege reduction, and attack-path reduction across hybrid identity systems.

Key terms

• Service Account: A special-purpose account used by applications, automated tools, or services rather than a human user to interact with systems, APIs, and infrastructure. Service accounts are a primary category of NHI and one of the most frequently exploited attack vectors.
• Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.
• Attack Path Analysis: Attack Path Analysis is the process of mapping how an attacker could move from an initial foothold to a valuable target. It examines identities, permissions, network reachability, misconfigurations, and trust relationships to identify realistic routes of compromise. The goal is to prioritize controls that break the shortest and most likely paths.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.