Cloud Security Blind Spots Exposed by ‘Ghost Credentials’
A recent investigation into a seemingly minor insider incident has uncovered a potentially far-reaching identity problem in cloud systems. Researchers have discovered a web of “ghost credentials” and nonhuman identities (NHIs) that can move undetected through environments, escalating privileges to access sensitive systems. This hidden threat could leave organizations vulnerable to attacks from both inside and outside their networks.
Aleksandr Krasnov, a distinguished security architect at Ducker Tech Consulting, stumbled upon the issue while investigating an anomaly in a small cloud account. An AI-enabled workflow agent had been idle for 30 days when it suddenly woke up and began firing off API calls at unusual times. As Krasnov dug deeper, he uncovered a mesh of NHIs that lived outside traditional trust boundaries but still managed to access systems. This discovery has significant implications for organizations relying heavily on automated environments.
NHIs are essentially tokens, agents, and service accounts that exist outside the conventional trust model. They can quietly move through the environment, escalating privileges to gain root or administrator status. An attacker could exploit this vulnerability by searching for exposed tokens rather than launching a phishing campaign. According to Krasnov, this approach would take mere minutes, making it an attractive option.
To help organizations address this issue, Krasnov has developed NHI Hound, an open-source tool that ingests identity data from providers such as Okta, GitHub, and cloud IAM platforms. The tool exposes hidden trust links between human and nonhuman accounts, simulates worst-case abuse paths, and suggests remediation steps. It also collects a comprehensive inventory of NHIs and human identities, classifying them by trust-severity levels.
While informal testing with small to midsize companies has shown promising results, larger enterprises may struggle to manage their NHI trust graph using this tool. As organizations grow beyond 2,000 employees, the number of identities becomes overwhelming, making it difficult to track and address critical trust issues.
To make NHI Hound more suitable for larger organizations, Krasnov plans to improve visualization, usability, and output. This will enable them to effectively handle large identity graphs and tackle the complex problem of NHIs. With the rise of automated environments, it’s essential that organizations prioritize this issue and take proactive steps to identify and address potential blind spots.
For security-conscious readers, it’s crucial to recognize the importance of NHI Hound in identifying and mitigating hidden trust risks. As cloud systems continue to grow and evolve, staying ahead of these threats requires continuous vigilance and innovation. By leveraging tools like NHI Hound and adopting a proactive approach to identity management, organizations can reduce their exposure to potential attacks and maintain robust security posture.
Source: Dark Reading — 2026-07-28