Topic starter
25/10/2026 11:00 am
TL;DR: Semperis' analysis of AD service account governance finds discovery alone is not enough to judge risk. Teams need ownership, usage, and business context to tell whether an account still fits its purpose.
Editorial analysis by NHI Mgmt Group, based on content published by Semperis: “Change How You Protect Active Directory Service Accounts”.
Key questions
Q: Why do service accounts with normal-looking activity still create security risk?
A: Because normal-looking activity can still be dangerous when the account has more access than it needs, uses weaker protocols, or authenticates from an unexpected source.
Q: How should IAM teams decide which service accounts to prioritise first?
A: Start with accounts that have unclear ownership, wide application reach, weak authentication methods, or stale usage patterns.
Q: What breaks when service-account discovery is based on spreadsheets or memory?
A: Static discovery fails because it cannot keep pace with repurposed accounts, changing applications, or ownership turnover.
Practitioner guidance
- Build a live service-account inventory Replace static spreadsheets with a continuously updated inventory that records ownership, application dependency, last logon, and configuration state.
- Assign accountable owners to every account Require both account and application ownership so every service identity has a named business and technical steward.
- Baseline normal source-to-target usage Document where each account authenticates from, what it reaches, and which protocols it uses before you tighten access.
Bottom line: Service-account risk grows when discovery, ownership, and behavioural context are managed separately instead of as one lifecycle problem.
Glossary terms: Service Account Inventory, Behavior Baseline, Identity Blast Radius, Service Account Lifecycle
What's in the full announcement
Semperis's full article covers the operational detail this post intentionally leaves for the source:
- The inventory workflow for auto-classifying service accounts as AD changes
- The account details and timeline views used to investigate last logons, exposures, and attacks
- The usage-analysis context that links authentication source, destination, and protocol
- The detection signals for weak protocols, suspicious logons, and offline credential-cracking activity
👉 Read Semperis's analysis of AD service account discovery and governance →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 week ago 2 times by NHI Mgmt Group
27/10/2026 7:15 pm
Static service-account inventories create governance debt: The article shows that discovery alone does not solve service-account risk because ownership, purpose, and behaviour all drift over time. That is a lifecycle failure, not just a visibility problem. When inventories are maintained by memory or spreadsheet, the control surface is already obsolete by the time the next review happens. The practitioner conclusion is that service-account governance must be treated as a live operating process, not an administrative task.
A few things that frame the scale:
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What governance controls matter most for Active Directory service accounts?
A: The most important controls are continuous inventory, accountable ownership, dependency mapping, usage analysis, and context-aware detection. Together they let teams see what the account does, who relies on it, and whether its current behaviour still matches its purpose. Without those controls, service-account security becomes reactive and brittle.
👉 Read our full editorial: AD service account discovery fails without ownership and usage context
This post was modified 1 week ago by NHI Mgmt Group