Topic starter
25/06/2026 1:10 am
TL;DR: Compromised service accounts sit at the centre of destructive breaches, with Semperis citing the Merck NotPetya case where initial access came through a patching account and damages exceeded $1.4 billion. The lesson is that static passwords, excessive privilege, and forgotten identities turn routine machine accounts into durable breach paths.
Editorial analysis by NHI Mgmt Group, based on content published by Semperis: “Improve Hybrid AD Security with Automated Response and Streamlined Administration”.
By the numbers:
- The 2017 NotPetya attack on Merck caused damages exceeding $1.4 billion.
Key questions
Q: What breaks when service accounts keep long-lived standing access?
A: Long-lived standing access turns one intercepted credential into a reusable credential for lateral movement and persistence.
Q: Why do compromised service accounts create such a high-risk path for identity-based attacks?
A: Compromised service accounts are dangerous because they often carry elevated access and are trusted by systems that do not challenge their actions.
Q: How do security teams know if service account governance is actually working?
A: Governance is working when every service account has an owner, a workload, a retirement condition, and an auditable rotation path.
Practitioner guidance
- Map every service account to an owner and purpose Build an authoritative inventory that ties each service account to a business process, technical owner, and retirement trigger.
- Reduce standing privilege on patching and admin accounts Review service accounts used for infrastructure maintenance, deployment, and directory administration, then strip permissions that are not required for the task they perform.
- Automate rollback for anomalous account behaviour Configure response rules so that suspicious changes, unusual logons, or unexpected privilege use can disable the account or revert the change without waiting for manual intervention.
Bottom line: Service accounts remain one of the most exploitable identity types because they often combine static credentials, broad privileges, and poor ownership.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 10:23 am
Service account governance fails when identity is treated as a static object instead of an operational dependency. These accounts are created to keep processes running, but they frequently outlive the systems and people that originally owned them. That is why stale service-account inventory is not an administrative nuisance, it is a governance failure that widens breach exposure across the identity estate.
A few things that frame the scale:
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should organisations treat service account risk as part of AD hardening or NHI governance?
A: They should treat it as both, because service accounts are NHI assets that often determine the security of Active Directory itself. AD hardening controls the attack surface, while NHI governance controls ownership, lifecycle, and privilege across the accounts that keep core systems running.
👉 Read our full editorial: Service account protection now sits at the centre of breach reduction