Notifications
Clear all
Topic starter
06/07/2026 9:42 am
TL;DR: A persistent NHI problem in hybrid estates is that organisations still struggle to discover on-premises non-human accounts, map ownership, and manage lifecycle gaps across AD and Entra ID, according to Token Security. That matters because visibility, permissions, and offboarding remain the control points that decide whether service-account sprawl becomes breach surface.
NHIMG editorial — what this means for NHI practitioners
By the numbers:
- Only 5.7% of organisations have full visibility into their service accounts.
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface.
Questions worth separating out
Q: How should security teams inventory Active Directory service accounts for governance?
A: Start by identifying every account that is used by an application, workload, integration, or administrative process rather than a person.
Q: Why do service accounts in Active Directory create so much risk?
A: Service accounts often accumulate permissions, outlive their original purpose, and remain invisible to the teams that depend on them.
Q: What do security teams get wrong about hybrid Active Directory governance?
A: They often treat on-premises AD and cloud identity as separate problems, even when the same account is synchronised across both.
Practitioner guidance
- Map every AD service account to an accountable owner Create an inventory that links each account to a business owner, technical maintainer, and primary application dependency.
- Reconcile AD and cloud identity records on a fixed cadence Compare AD service accounts, synced cloud identities, and group memberships on a recurring basis so hybrid drift is visible before certification windows.
- Review nested groups and inherited ACLs for excessive reach Analyse AD permissions from the object level upward so inherited access, nested group membership, and shared service identities are all captured in the same review.
What's in the full announcement
Token Security's full blog covers the operational detail this post intentionally leaves for the source:
- The integration workflow for discovering AD service accounts and comparing them with Entra ID records
- Screenshots and identity graph views showing ownership, usage patterns, and permission context
- The remediation features the vendor says can help close stale-account and excess-privilege gaps
- The article's walkthrough of AD permission complexity, including nested groups and ACL inheritance
👉 Read Token Security's Active Directory integration post for NHI visibility details →
Active Directory NHI visibility gaps: what IAM teams miss?
Explore further
06/07/2026 9:58 am
Active Directory visibility is now an NHI governance baseline, not an optional enhancement. The article is really describing a common control failure: organisations cannot govern what they cannot reliably enumerate. Service accounts hidden inside AD often lack clear ownership, usage context, and lifecycle status, which makes discovery the first governance milestone. The practitioner conclusion is straightforward: if AD identities are not fully visible, every downstream control is weakened.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to Ultimate Guide to NHIs.
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
A question worth separating out:
Q: How can IAM teams reduce blast radius from overprivileged directory accounts?
A: Reduce the number of accounts with broad group membership, review inherited access paths, and remove shared service identities where possible. The goal is not just smaller privilege sets but shorter exposure windows, clearer accountability, and fewer paths for lateral movement if an account is compromised.
👉 Read our full editorial: Active Directory visibility gaps are still widening NHI risk
