Notifications
Clear all
Topic starter
27/06/2026 1:39 pm
TL;DR: ISPM tools can surface risky configurations, but they do not detect when a seemingly clean service account starts behaving outside its normal pattern, according to Abnormal AI. Behavioral baselines for auth timing, source IPs, and access patterns expose the gap between static posture and live conduct, which is where breach detection now has to start.
NHIMG editorial — based on content published by Abnormal AI: Key Insights on behavioural detection for non-human identities
By the numbers:
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes , and as quickly as 9 minutes in some cases.
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities , 46% confirmed, 26% suspected.
Questions worth separating out
Q: How should security teams monitor service accounts beyond access reviews?
A: Security teams should combine access reviews with behavioural monitoring that tracks when a service account authenticates, where it connects from, and what it touches after login.
Q: Why do clean-looking service accounts still create breach risk?
A: Clean-looking service accounts still create breach risk because configuration tells you what the identity is allowed to do, not what it actually does once credentials are live.
Q: What do teams get wrong about non-human identity posture tools?
A: Teams often assume posture tools are enough because they expose excessive permissions, stale accounts, and rotation gaps.
Practitioner guidance
- Baseline service account behaviour by identity family Build separate behavioural profiles for service account groups, not a single NHI baseline.
- Wire behavioural anomalies into IAM and SOC workflows Escalate anomalous NHI activity into both incident response and identity governance queues.
- Review long-lived service accounts for behavioural blind spots Prioritise service accounts that were created years ago, reused across systems, or never given a documented operating profile.
What's in the full article
Abnormal AI's full article covers the operational detail this post intentionally leaves for the source:
- The product-side implementation pattern for behavioural baselines across service accounts and other NHI classes.
- The specific telemetry fields used to compare current conduct with expected identity behaviour.
- The vendor's engineering framing for how anomalous NHI activity should be detected before breach escalation.
- The product and engineering context behind the behavioural model, which is useful once you are past strategy and into deployment.
👉 Read Abnormal AI’s analysis of behavioural detection for NHI posture blind spots →
NHI posture tools miss conduct changes. What should teams do?
Explore further
27/06/2026 3:04 pm
Static posture management cannot see the moment an NHI becomes dangerous. That is the central limitation this article exposes. ISPM can show over-privilege, stale rotation, and inventory gaps, but a compromised service account can still remain posture-clean while doing entirely abnormal things. Practitioners should treat that as a governance boundary, not a tooling feature gap.
A few things that frame the scale:
- Two-thirds of enterprises have endured a successful cyberattack resulting from compromised non-human identities, with a quarter encountering multiple attacks, according to The 2024 ESG Report: Managing Non-Human Identities.
- Enterprises that have experienced a compromised NHI averaged 2.7 separate incidents in the past 12 months, according to The 2024 ESG Report: Managing Non-Human Identities.
A question worth separating out:
Q: How do organisations decide when NHI behaviour is suspicious enough to investigate?
A: Organisations should investigate when an NHI deviates from its baseline in more than one dimension, such as timing, source IP, and access sequence. A single odd event may be noise, but repeated divergence across those signals suggests the identity is no longer operating within its normal function.
👉 Read our full editorial: Behavioral detection closes the blind spot in NHI posture tools
