Topic starter
06/07/2026 9:42 am
TL;DR: A persistent NHI problem in hybrid estates is that organisations still struggle to discover on-premises non-human accounts, map ownership, and manage lifecycle gaps across AD and Entra ID, according to Token Security. That matters because visibility, permissions, and offboarding remain the control points that decide whether service-account sprawl becomes breach surface.
Editorial analysis by NHI Mgmt Group, based on content published by Token Security: “Token Integrates with Active Directory”.
By the numbers:
- The median time-to-AD for all attacks was just 0.68 days, or about 16 hours.
- The use of Impair Defenses rose from 24% in 2021 to 43% in the first half of 2023.
Key questions
Q: What breaks when service accounts in Active Directory are not clearly owned?
A: Lifecycle governance breaks first, because no one can confidently attest, rotate, or decommission the account.
Q: Why do attackers focus on Active Directory so early in a breach?
A: Attackers focus on Active Directory early because it is the trust source for authentication and authorization in many environments.
Q: How do security teams know if service account governance is actually working?
A: Governance is working when every service account has an owner, a workload, a retirement condition, and an auditable rotation path.
Practitioner guidance
- Map every service account to an owner and maintainer Create a single inventory that ties each AD service account to a business owner, technical maintainer, and consuming application.
- Review effective permissions on AD objects Analyse ACLs, nested groups, and inherited rights to determine the real access path for service accounts and privileged principals.
- Identify long-standing and unrotated credentials Prioritise service accounts whose passwords or secrets have not changed in a long time, especially where they can reach critical servers or directories.
Bottom line: Active Directory visibility gaps turn service accounts into unmanaged access paths, especially when ownership and dependency data are incomplete.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/07/2026 9:58 am
Visibility is the control boundary for NHI governance in Active Directory. When organisations cannot see service accounts, ownership, usage, and dependency chains, they are not merely missing data. They are missing the prerequisites for offboarding, privilege review, and accountability. The practical conclusion is that AD identity governance starts with discovery completeness, not with remediation workflows.
A few things that frame the scale:
- 96% of security operations teams report critical blind spots, most commonly in cloud infrastructure (74%) and identity and access behaviour (67%).
A question worth separating out:
Q: What is the difference between a visible AD identity and a governed one?
A: A visible AD identity can be discovered in inventory, but a governed identity has an accountable owner, an understood business purpose, reviewed access scope, and a lifecycle decision attached to it. Visibility tells you the account exists. Governance tells you whether it should still exist and who is responsible for it.
👉 Read our full editorial: Active Directory visibility gaps are still widening NHI risk