Non-Human Identities Now Primary Corporate Entry Point for Attackers

Compromised non-human identities (NHIs), including AI agents, service accounts, and API keys, are now the most likely route for attackers to infiltrate corporate networks, according to a new analysis. These machine identities now account for 31% of intrusions, nearly double the 17% attributed to traditional social engineering tactics like phishing.

The findings stem from SpyCloud’s Identity Threat Report, which surveyed 750 cybersecurity leaders and practitioners in organisations with over 500 employees across North America and Europe. The report highlights a significant gap in organisational awareness and control over these often-privileged machine identities.

Despite 95% of organisations believing they have adequate visibility into their NHIs, only 36% actively monitor them, making machine identities the least-watched category of identity risk. This lack of oversight is exacerbated by the fact that NHIs are frequently granted elevated privileges and are often not properly decommissioned or have their credentials rotated, creating persistent security vulnerabilities that attackers are actively exploiting.

“Every one of these identities is a standing invitation that renews itself until someone notices,” stated Trevor Hilligoss, SpyCloud’s chief intelligence officer. This suggests a fundamental asymmetry in how organisations manage human versus machine identities, with the latter often falling through the cracks.

Governance Gaps Emerge Around AI Agents

The report also detailed a disconnect between the rapid adoption of AI and the establishment of formal governance processes. While nearly all surveyed organisations reported using AI tools or agents with access to internal systems, applications, or data, only 56% have established formal processes to govern their privileges. A substantial 41% rely on informal methods or lack clear ownership.

Visibility into identity-related risks proved crucial for maintaining a robust security posture. Organisations with insight into stolen session cookies experienced identity-based events at a significantly lower rate (37%) compared to those without such visibility (50%).

Supply chain attacks also remain a significant concern, with malware-infected third-party devices (23%) and exposed API keys or vendor access (22%) being primary causes of identity-related events in the supply chain. However, nearly two-fifths of respondents admitted to not having consistent processes for confirming third-party identity exposure, despite a third planning to focus on supply chain risk management in the coming 18 months.

Hilligoss emphasised that organisations cannot afford to leave any part of their attack surface unmanaged. “We hardened passwords, so they targeted sessions; we tightened employee accounts, so they looked to service accounts and vendor connections,” he observed, illustrating how attackers adapt to security improvements by targeting less protected areas.