Topic starter
17/08/2026 4:41 pm
TL;DR: Akeyless says identity-based attacks are increasingly exploiting cloud resources, secrets sprawl and machine identities, with Ross Young arguing that credentials valid for 90 days or more leave attackers a large operating window. Short-lived credentials, tighter inventory and faster rotation are becoming the practical baseline, not an optimisation.
Editorial analysis by NHI Mgmt Group, based on content published by Akeyless: “Why Identity-Based Attacks Are on the Rise: Insights from Former CISO of Caterpillar Financial”.
Key questions
Q: What breaks when organisations keep using standing privileges for machine identities?
A: Standing privilege turns NHIs into persistent trust anchors.
Q: Why do long-lived secrets increase breach risk in cloud and fintech environments?
A: Long-lived secrets extend the time an attacker can reuse stolen access, which increases the chance of data theft, lateral movement, and compliance failure.
Q: How can teams reduce blast radius for remote and machine access?
A: Teams can reduce blast radius by combining JIT access, PAM, and strong identity inventory.
Practitioner guidance
- Inventory machine identities and their privilege scopes Map service accounts, CI/CD credentials, API keys and certificates to the systems they can reach, then remove identities that cannot be tied to an owner and purpose.
- Shorten credential lifetime aggressively Replace 90-day or longer credential windows with ephemeral or daily rotation patterns where operationally possible, especially for high-value cloud and DevOps paths.
- Remove secrets from source code and pipeline variables Block hardcoded secrets in repositories, build logs and deployment templates, then shift to controlled issuance and retrieval at runtime.
Bottom line: Identity-based attacks succeed when attackers can abuse trusted identities instead of breaking through the perimeter first.
What's in the full article
Akeyless' full post covers the operational detail this post intentionally leaves for the source:
- Ross Young's examples of how phishing, developer compromise and cloud access evolved as attack paths
- Practical guidance on moving from 90-day credentials to ephemeral access and daily rotation
- The discussion of how PAM assumptions break in containers and infrastructure-as-code workflows
- Akeyless' summary of zero-knowledge secrets handling and SaaS operating trade-offs
👉 Read Akeyless' analysis of identity-based attacks across human and machine identities →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
17/08/2026 4:46 pm
Identity governance now fails first at lifetime, not login. The core problem in this article is not simply weak authentication. It is that many identity programmes still assume credentials will exist long enough to be reviewed, rotated or certified on a human schedule. When cloud access and DevOps automation compress access into short operational bursts, the governance model falls behind the attack model.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What is the difference between machine identity security and human IAM?
A: Human IAM is built around interactive authentication, user review, and role assignment. Machine identity security is about credentials that run in code, pipelines, and services, so the priority is inventory, rotation, and lifecycle control. Machines can scale faster than human governance processes, which is why discovery and expiry matter more than login experience.
👉 Read our full editorial: Identity-based attacks are outpacing human and machine controls