In 2026, the cloud security community is staring at a new, unsettling reality: nonhuman identity sprawl is silently inflating attack surfaces. Security researcher Aleksandr Krasnov says dormant, non‑human credentials can hide within trust relationships, creating blind spots that even seasoned engineers often overlook.
Key Takeaways
- Ghost credentials—dormant nonhuman identities—are surfacing as a hidden threat in cloud environments.
- Krasnov plans to release an open‑source tool at Black Hat USA 2026 that maps trust paths to expose these blind spots.
- Existing identity‑centric controls may miss dormant accounts because they’re not actively used.
- Developers and cloud architects need to adopt continuous trust‑path validation to mitigate risk.
- Early detection can prevent attackers from using ghost credentials for lateral movement.
Historical Context
Identity‑centric security has long centered on human actors. Early cloud adoption emphasized password policies, multi‑factor authentication, and audit logs for user logins. As automation grew, service accounts and API keys proliferated, but the focus remained on active usage patterns. The industry began to notice occasional “orphaned” keys during post‑mortem analyses, yet those incidents were treated as anomalies rather than a systemic issue.
Over the past few years, a pattern emerged: many organizations built complex micro‑service architectures that relied heavily on temporary credentials for short‑lived jobs. Those temporary identities often persisted far beyond their intended lifespan. The lingering artifacts created a subtle expansion of the attack surface that standard monitoring tools failed to capture.
That evolution set the stage for what Krasnov now calls nonhuman identity sprawl. The term captures the collective growth of machine‑generated identities that sit idle, yet retain permissions. It reflects a shift from a user‑only mindset to a broader view where every credential—human or not—must be accounted for.
Understanding the nonhuman identity sprawl Threat
Most cloud security strategies focus on user‑driven identities—people logging in with passwords or keys. What Krasnov highlights is that machines, services, and automation scripts also generate identities, and many of those sit idle for months or years. That’s the catch. Those dormant accounts still retain permissions, and if a breach occurs, attackers can activate them to slip past traditional monitoring.
Because the identities aren’t tied to active sessions, they rarely generate logs. It didn’t work. That’s why they become “ghost” credentials, lurking in the background while security tools stare at noisy traffic from active users.
Why Dormant Identities Slip Through
Security platforms typically flag anomalous activity—logins from unusual locations, spikes in API calls, or privilege escalations. When an identity hasn’t touched the system in a long time, there’s nothing to flag. It’s a blind spot that the industry hasn’t fully addressed.
“Dormant nonhuman identities can create security blind spots,” Krasnov told Dark Reading.
“These ghost credentials often sit unnoticed, granting attackers a hidden foothold once they breach a perimeter.”
The quote underscores the irony: what we build to automate and scale can also become the very thing that undermines our defenses.
What the Upcoming Open‑Source Tool Aims to Do
At Black Hat USA 2026, Krasnov will unveil a utility designed to sniff out trust paths that involve dormant identities. The tool will map relationships between service accounts, APIs, and resource permissions, highlighting any credential that exists without recent activity. In practice, the tool will crawl IAM policies, service‑mesh configurations, and role‑based access controls to produce a visual map of trust.
That’s remarkable. By visualizing these paths, teams can see where a ghost credential could be used to move laterally. The tool doesn’t just list idle accounts; it shows how they connect to critical resources, making remediation decisions more precise.
- Scans IAM policies for unused service accounts.
- Identifies trust relationships that cross project or account boundaries.
- Generates a graph highlighting high‑risk paths.
- Offers remediation suggestions, such as revoking or rotating credentials.
Implications for Cloud Architects
Architects who’ve built sprawling micro‑service ecosystems often rely on dozens of service accounts. When those accounts sit idle, they’re like doors left ajar. You can’t lock a door you never knew existed. That’s why continuous validation of trust paths matters more than ever.
It’s not enough to audit user accounts quarterly. You need an ongoing process that checks for stale permissions and automatically flags them. The upcoming tool promises to fill that gap, but teams should also consider integrating similar checks into CI/CD pipelines.
Practical Steps Before the Tool Arrives
While waiting for the open‑source release, organizations can start by inventorying all nonhuman identities. Pull a list of service accounts from IAM dashboards, then cross‑reference with recent activity logs. If an account hasn’t made a call in the past 90 days, treat it as a candidate for review.
Don’t assume that revoking a credential won’t break a service. Instead, test the impact in a staging environment. If the service fails, you either need to redesign the dependency or rotate the credential with a fresh secret.
Developer Impact: Why This Matters to You
Developers often delegate authentication to managed services, trusting that the platform will handle credential rotation. That trust is sensible, but it also means developers might overlook dormant identities that were created during early prototype phases and never cleaned up.
When you push code that creates a new service account, you should also embed a cleanup routine. Automation scripts that spin up temporary resources should include a step that deprovisions the associated identity after use.
Integrating Trust‑Path Checks Into CI/CD
Modern pipelines can run static analysis tools that flag hard‑coded secrets. Extending that capability to detect unused service accounts is a logical next step. A simple script that queries the cloud provider’s IAM API for accounts with zero login events in the past month can be part of the build validation stage.
That’s a practical way to keep ghost credentials from creeping into production. It won’t replace the upcoming tool, but it gives teams a foothold in the meantime.
Competitive Landscape
Several vendors have introduced identity‑governance modules that focus on user lifecycle management. Those solutions typically automate provisioning, de‑provisioning, and password rotation for human accounts. The current gap lies in extending those capabilities to machine‑generated identities that lack a clear owner.
Some platform providers have started to surface usage metrics for service accounts, but the depth of analysis varies. In environments where multiple teams share a single cloud tenancy, cross‑team visibility becomes a challenge. A unified view that correlates service accounts with the resources they can access is still emerging.
Open‑source initiatives, like the tool Krasnov will release, aim to level the playing field. By offering a vendor‑agnostic approach, they encourage broader adoption of trust‑path validation regardless of the underlying cloud provider.
Regulatory Implications
Compliance frameworks increasingly stress the principle of least privilege and require evidence of ongoing access reviews. While those mandates traditionally target human users, auditors are beginning to ask about machine credentials as well. Ignoring dormant service accounts could be interpreted as a failure to maintain adequate controls.
Regulators may start to request documentation of how organizations discover and remediate unused identities. Demonstrating a systematic process—such as regular scans and remediation tickets—helps satisfy audit inquiries and reduces exposure to potential penalties.
What This Means For You
If you’re responsible for securing cloud workloads, start treating nonhuman identities with the same rigor you apply to user accounts. Conduct regular audits, automate detection of idle service accounts, and incorporate trust‑path analysis into your security tooling. Ignoring these ghost credentials could give attackers a foothold that bypasses most detection mechanisms.
Developers should embed cleanup logic in any automation that creates temporary identities. By doing so, you reduce the attack surface before it even appears. In short, proactive hygiene beats reactive fire‑fighting every time.
Looking ahead, the real question is whether the industry will adopt continuous trust‑path scanning as a standard practice, or if ghost credentials will remain a hidden threat lurking in the shadows of cloud environments.
Key Questions Remaining
- How will large enterprises scale continuous trust‑path validation across multiple cloud accounts?
- What metrics will organizations use to measure the effectiveness of ghost‑credential remediation?
- Can existing security information and event management (SIEM) platforms be extended to surface dormant identities without major re‑architecting?
- Will regulatory bodies evolve guidelines to explicitly require monitoring of nonhuman identities?
Sources: Dark Reading, The Register
