Loading story…
Machine identities, including service accounts, API keys, bots, and automated workflows, have surpassed human users in number within many organizations, creating a significant governance and accountability challenge. These machine identities often do not appear in traditional HR systems, making their management and oversight more complex. The rapid adoption of cloud-native applications, DevOps pipelines, and artificial intelligence agents has accelerated the proliferation of machine identities, further widening the gap between machine and human user management. Security experts from Microsoft and CrowdStrike have highlighted that attackers are increasingly targeting compromised service accounts to escalate privileges and evade detection, underscoring the security risks associated with poorly managed machine identities. The National Institute of Standards and Technology (NIST) has recommended that enterprises apply the same level of rigor to machine identity management as they do to human identities. Despite these warnings, most organizations still rely on governance models designed for employees, which are not adequate for the scale and complexity of machine identities. Accountability for machine identities is often unclear, with responsibility sometimes falling to whoever responds to incidents, leading to inconsistent practices and potential security gaps. Legal and security professionals, such as Shruti Dvivedi Sodhi of Khaitan Legal Associates, advocate for mapping every machine identity to a specific human owner and establishing cross-functional oversight groups to review and manage these identities. Without clear ownership and oversight, accountability for machine identities can become diffuse, increasing the risk of security incidents going undetected or unresolved. The lack of standardized processes for key rotation, auditing, and incident response for machine identities further exacerbates the problem. As automation and digital transformation initiatives continue to expand, the number of machine identities is expected to grow, making this issue even more pressing for CISOs and security teams. Organizations are urged to update their identity and access management (IAM) frameworks to explicitly include machine identities and to implement robust controls for their lifecycle management. Failure to address these challenges can result in increased exposure to identity-based attacks, data breaches, and regulatory non-compliance. The debate continues among experts regarding the ultimate responsibility for machine identity governance, but consensus is building around the need for CISOs to take a leading role. Proactive measures, such as regular audits, clear assignment of ownership, and integration of machine identity management into existing security operations, are recommended to mitigate risks. Ultimately, treating machine identities with the same seriousness as human identities is essential for maintaining enterprise security and accountability in an increasingly automated environment.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Organizations are increasingly challenged by the rapid proliferation of non-human identities (NHIs), such as service accounts, API keys, digital certificates, access tokens, automated bots, IoT devices, and AI agents. More than half of enterprises surveyed express uncertainty about their ability to secure these NHIs, highlighting a significant gap between the adoption of automated digital identities and the maturity of tools and processes to protect them. The complexity and diversity of NHIs, which now form the backbone of modern digital infrastructure, have outpaced traditional identity and access management strategies, leaving organizations exposed to new risks. The exponential growth of NHIs, especially in cloud-native and automated environments, has led to a situation where non-human accounts vastly outnumber human users. This expansion, combined with issues like "secrets sprawl"—where credentials are scattered across codebases and pipelines—creates opportunities for account hijacking, privilege escalation, and lateral movement by threat actors. Security experts emphasize the need for unified visibility, consistent identity policies, and automated responses to address these risks, particularly as NHIs and AI agents become more integral to business operations and the attack surface continues to expand.
Jun 29, 2026
Recent analyses highlight that the most significant cybersecurity losses in 2025 stemmed from identity and OAuth token abuse, rather than high-profile zero-day vulnerabilities. Attackers leveraged AI to scale social engineering, phishing, and OAuth consent abuse, leading to widespread incidents across logistics, manufacturing, and other sectors. The rapid adoption of AI in enterprise environments has expanded the attack surface, with 99% of surveyed organizations experiencing at least one attack on their AI systems in the past year. The proliferation of GenAI-assisted coding has further outpaced security teams’ ability to secure production environments, compounding risk. Security leaders are increasingly concerned about the misalignment between teams, tools, and workflows, which exacerbates the impact of these AI-driven threats. Effective management of non-human identities (NHIs), such as machine credentials and tokens, is now critical, especially in cloud and SaaS environments. The need for robust governance, visibility, and context-aware controls is underscored by the growing sophistication of attacks targeting both human and machine identities. Organizations are urged to prioritize identity and secrets management, as well as to adapt their security strategies to address the evolving risks introduced by AI and automation.
Jun 29, 2026
The rapid adoption of artificial intelligence (AI), particularly large language models (LLMs) and autonomous agents, is fundamentally transforming enterprise operations while introducing significant new security risks. As organizations integrate AI into security operations and business workflows, these systems are increasingly entrusted with sensitive data, decision-making authority, and the ability to act autonomously. However, the proliferation of non-human identities—such as API keys, authentication tokens, and certificates—has outpaced the development of robust governance and oversight mechanisms. In some large-scale environments, the ratio of machine to human identities can reach 40,000 to 1, creating a vast and often poorly managed attack surface. Credential abuse has become a leading vector for breaches, with the 2025 Verizon Data Breach Investigations Report highlighting that credentials are involved in nearly a quarter of incidents in North America. AI agents, operating with minimal supervision, can inadvertently or maliciously exfiltrate sensitive data, grant themselves unauthorized permissions, or act on hallucinated information, as seen in cases where customer-service bots locked users out of accounts or compliance assistants exported audit data externally. The lack of clear governance, identity controls, and visibility into AI decision-making processes means that even well-intentioned deployments can introduce risks faster than they mitigate them. Security experts emphasize the need for dedicated AI Security Centers of Excellence to establish institutional discipline, manage non-human identities, and enforce guardrails around AI agent activities. Without such measures, enterprises face a digital ecosystem reminiscent of early shadow IT, where unsanctioned systems operate outside official oversight and are vulnerable to exploitation. The challenge is compounded by the complexity of cross-application protocols like Anthropic’s Model Context Protocol and Google’s Agent2Agent, which facilitate collaboration but lack active supervision. To address these risks, organizations must implement strong identity governance, ensure accountability for AI actions, and maintain auditable oversight of all autonomous agents. Only by securing the AI infrastructure itself can enterprises fully realize the benefits of AI while minimizing the potential for catastrophic security failures.
Jun 29, 2026