Compromised Non-Human Identities Now Top Corporate Entry Point for Hackers, Study Finds

Compromised non-human identities (NHIs) are now the primary avenue for cybercriminals to breach corporate networks, eclipsing social engineering tactics like phishing, a new report from SpyCloud claims. The firm’s Identity Threat Report indicates that NHIs, which encompass AI agents, service accounts, API keys, and authentication tokens, accounted for 31% of enterprise intrusions. This figure is nearly double the 17% attributed to social engineering methods.

The findings are particularly concerning given a significant gap in visibility and monitoring. While 95% of surveyed organisations believe they have adequate insight into their NHIs, only 36% actively monitor them. This discrepancy makes machine identities the least-watched category of identity risk, according to SpyCloud. The report surveyed 750 cybersecurity leaders and practitioners at organisations with over 500 employees across North America and several European countries.

Furthermore, 68% of respondents reported experiencing an identity-based security event during the reporting period, with NHI-related misuse being a significant contributor at 42%. SpyCloud highlights that NHIs often possess elevated privileges and are frequently not deprovisioned or have their credentials rotated, creating persistent security risks. “That asymmetry is what attackers are exploiting,” stated Trevor Hilligoss, SpyCloud’s chief intelligence officer. “Every one of these identities is a standing invitation that renews itself until someone notices.”

AI Governance Lags Behind Adoption

The report also pointed to a mismatch between the adoption of AI tools and the establishment of formal governance processes. While nearly all organisations surveyed use AI tools or agents with access to internal systems, applications, or data, only 56% have formal processes governing their privileges. A substantial two-fifths (41%) rely on informal processes or partial ownership for AI governance, leaving potential blind spots.

Visibility into identity-related risks was identified as a critical component of a robust security posture. Organisations with insight into stolen session cookies experienced identity-based events at a substantially lower rate (37%) compared to those lacking such visibility (50%).

Supply chain attacks remain a persistent threat, with malware-infected third-party devices (23%) and exposed API keys or application access involving vendors and partners (22%) being primary causes of identity events. Despite this, nearly two-fifths of organisations admitted to not having a consistent process for confirming third-party identity exposure, even as a third (32%) plan to focus on supply chain risk management in the coming 18 months. Hilligoss emphasised that organisations cannot afford to leave any part of their attack surface unmanaged, as hardening one area often pushes attackers towards less protected vectors.

The full SpyCloud Identity Threat Report details further insights into the evolving landscape of cyber threats and identity management. Organisations are urged to reassess their strategies for monitoring and securing all forms of digital identities, particularly the increasingly prevalent non-human ones, to effectively defend against sophisticated cyberattacks.

Read the original report on Infosecurity Magazine.