AI Summary

Enterprise security teams face a hidden workforce of non‑human identities that outnumber humans in most large organisations, often by ten to one. These bots, service accounts, API keys, OAuth tokens, and machine certificates authenticate continuously across environments and, when forgotten, do not retire gracefully, accumulating privilege over time. Security practitioners call them “ghost identities” because they linger unseen and can be exploited by attackers. The SolarWinds breach illustrated this risk: attackers used existing machine identities with significant access, remaining undetected for months across 18,000 organisations. Uber’s 2022 incident highlighted a service account that was unowned and whose credentials had not been rotated for an unknown period.

AI summaries can be wrong sometimes—always verify important details using the source article.