Notifications
Clear all
Topic starter
24/06/2026 11:19 pm
TL;DR: Stolen credentials now take an average 292 days to identify and contain, according to IBM, and workload identities make that detection problem harder because legitimate tokens, API keys, and certificates blend into normal machine traffic. Traditional IAM assumptions break when the actor is a service account or AI agent, because access can look authorized even when it is compromised.
NHIMG editorial — based on content published by Aembit: behavioral monitoring for workload identities and AI agents
By the numbers:
- 47.1 percent of cloud incidents in H1 2025 involved weak or absent credentials.
- 46.4 percent of security alerts involved overprivileged service accounts in H2 2024.
- More than 60 percent of large enterprises deployed autonomous AI agents in production by 2025.
Questions worth separating out
Q: How should security teams monitor workload identities for compromise?
A: Security teams should monitor workload identities by combining behavioural baselines, context-aware telemetry, and graph-based access relationships.
Q: Why do service accounts and API keys create different risks from human logins?
A: Service accounts and API keys create different risks because they authenticate successfully even when stolen, which removes the failed-login signals that help expose human account abuse.
Q: What breaks when workload identity access is governed like human access?
A: What breaks is the assumption that suspicious activity will be visible through user-centric signals such as odd hours, unfamiliar locations, or MFA challenges.
Practitioner guidance
- Instrument workload-identity baselines by role Track normal source IPs, regions, API targets, request rates, and dependency chains for each service account, token, and AI agent.
- Separate human, workload, and agent governance policies Do not apply one access model across people, service accounts, and AI agents.
- Prioritise short-lived credentials over standing secrets Reduce the number of long-lived API keys and tokens that can be reused after compromise.
What's in the full article
Aembit's full article covers the operational detail this post intentionally leaves for the source:
- Step-by-step behavioural monitoring methods for workload identities across cloud platforms and SIEM integrations
- Specific detection patterns for anomalous API activity, credential leakage, and identity saturation
- Implementation detail for SPIFFE-based workload identity and short-lived credential rotation
- Examples of cloud-native telemetry and trace correlation used to distinguish normal scaling from compromise
👉 Read Aembit's analysis of behavioural monitoring for workload identities →
Workload identity monitoring: why valid credentials hide compromise?
Explore further
25/06/2026 8:08 am
Valid credentials have become the stealth layer of modern compromise. The core problem is no longer whether an identity can authenticate, but whether that authentication still proves legitimate intent. When service accounts, API keys, and certificates are accepted at face value, the defender loses the signal that human login monitoring used to provide. Practitioners need to treat credential validity as necessary but insufficient evidence of trust.
A few things that frame the scale:
- 28.65 million new hardcoded secrets were detected in public GitHub commits in 2025 alone, a 34% year-over-year increase and the largest single-year jump ever recorded, according to Guide to the Secret Sprawl Challenge.
- 28% of secrets incidents now originate outside code repositories, in Slack, Jira, and Confluence, and they are 13% more likely to be categorised as critical than code-based leaks.
A question worth separating out:
Q: How do organisations reduce the blast radius of stolen non-human credentials?
A: Organisations reduce blast radius by shortening credential lifetime, limiting assigned permissions, and correlating each access event to a specific workload or agent context. That makes reuse harder, narrows lateral movement, and improves the chance of spotting a credential being used outside its intended role.
👉 Read our full editorial: Why workload identity monitoring is failing under valid credentials
