In the complex architecture of modern cloud infrastructure, the most significant threats often stem from what remains unseen rather than what is actively monitored. While security teams frequently dedicate vast resources to managing human access and permissions, a silent and growing danger lurks within the automated layers of the enterprise. Security researcher Aleksandr Krasnov has brought this critical vulnerability to light, revealing how dormant non-human identities (NHIs) accumulate within cloud environments to create ghost credentials that malicious actors can exploit to bypass perimeter defenses.
At the heart of this research is the phenomenon of identity sprawl, where service accounts, tokens, and API keys are provisioned for specific tasks but are never decommissioned. These dormant credentials linger long after the associated projects or workloads have been retired, effectively becoming ghost users within the system. The danger lies in the persistence of their permissions; because they are no longer in active use, security teams rarely monitor them, yet they retain high levels of trust within the system. Krasnov’s analysis demonstrates that these abandoned identities create valid trust paths that an attacker can leverage to move laterally through a network with minimal resistance. To combat this visibility gap, Krasnov has introduced NHI Hound, a new open-source tool engineered to discover these overlooked identities and trace the trust paths they create, giving defenders a method to identify and neutralize these silent risks before they can be weaponized.
For security operations centers and cloud architects, the implications of this research are profound. Traditional identity governance strategies are typically built around user lifecycles—onboarding and offboarding personnel—but lack the necessary mechanisms to manage the lifecycle of machine identities. This creates a massive blind spot where active permissions are held by entities that no longer serve a business purpose. The existence of dormant NHIs implies that an attacker need not steal a live user's credentials; they simply need to find an abandoned service key that has been left active in the codebase or configuration files. Consequently, security teams must pivot from a purely human-focused mindset to one that prioritizes non-human identity hygiene. This involves implementing automated discovery processes to continuously inventory service accounts and rigorously enforcing policies that revoke permissions when the associated workload is decommissioned.
The emergence of ghost credentials in cloud environments underscores the urgent need for a more holistic approach to security hygiene. As organizations rely increasingly on automation, the proliferation of non-human identities is inevitable, but the security risks they pose are manageable with the right visibility. By incorporating tools like NHI Hound into regular auditing practices, security teams can expose the hidden pathways that attackers might otherwise use to move undetected through a network. Protecting the modern cloud infrastructure requires looking beyond human users to secure the silent, automated workforce that powers the digital enterprise, ensuring that dormant access does not become an open door for adversaries.