How to detect compromised non-human identities

Key takeaways

• Valid machine credentials often allow compromised non-human identities to evade traditional Identity and Access Management (IAM) detection.
• Up to two-thirds of organizations have experienced a security breach stemming directly from a compromised or unmanaged non-human identity.
• The 2026 SANS ITDR Survey found that 73% of organizations have deployed AI agents with credentials but without governance controls.
• OWASP identifies excessive permissions, secret leakage, and vulnerable third-party non-human identities (NHIs) as leading risks.
• Organizations reduce risk by continuously discovering identities, understanding access, and enforcing governance.

How to detect compromised non-human identities

Organizations detect compromised non-human identities by monitoring how machine identities normally behave and investigating changes in access, permissions, and credential usage rather than relying on authentication failures alone.

• Establish behavioral baselines for service accounts, API tokens, OAuth grants, workload identities, and AI agents.
• Alert on unusual access requests, privilege escalation, new trust relationships, or unexpected resource access.
• Investigate dormant identities that suddenly become active or credentials used from unfamiliar systems, workloads, or regions.
• Continuously review permissions, ownership, and blast radius to identify excessive access before it can be exploited.

Quick facts

Non-human identity risks and mitigation strategies

Why compromised non-human identity behavior is so difficult to detect

Human account compromise often generates obvious indicators such as unusual login locations, failed MFA challenges, or suspicious activity alerts.

Compromised NHIs are different. Because service accounts, OAuth tokens, Kubernetes workload identities, and AI agents already have legitimate access, attackers can often operate without triggering traditional alerts.

The OWASP Non-Human Identities Top 10 identifies excessive permissions, secret leakage, vulnerable third-party NHIs, and improper offboarding among today's most common machine identity risks.

Consider a GitHub Actions service account used to deploy applications to AWS. Over time, it accumulated access to repositories, AWS accounts, secrets, and SaaS applications. When an attacker steals the account's token through a compromised third-party GitHub Action, they simply inherit that access.

The challenge is not detecting the login. It's in detecting the unauthorized non-human identity behavior before it becomes a major problem.

Why does a compromised non-human identity create so much risk?

A compromised NHI often has broader access than an employee. Machine identities routinely deploy code, manage infrastructure, access sensitive data, and communicate across applications and APIs.

As our GitHub Actions example shows, a deployment account that began with limited permissions can gradually accumulate access to secrets, AWS accounts, infrastructure management functions, and monitoring systems. Once the token is compromised, the attacker inherits all of that access instantly.

GitHub warns that compromising a single GitHub Action can expose repository secrets.

The danger grows as permissions accumulate. Palo Alto notes that 99% of cloud identities have excessive permissions, creating a vulnerable attack surface.

A compromised deployment account may provide access to source code, cloud resources, secrets vaults, and production workloads simultaneously. That is why understanding blast radius is just as important as detecting the compromise itself.

Spotting compromised non-human identity behavior through detection monitoring

The most reliable indicator is often a change in NHI behavior. Our compromised GitHub Actions account began exhibiting unusual behavior, such as:

• Unusual resource access: The account starts querying customer databases and accessing storage buckets it has never touched before.
• Unexpected privilege use: It begins invoking IAM administrative actions that were technically permitted but never previously used.
• Geographic anomalies: API calls originate from cloud regions where the deployment pipeline has never operated.
• Credential reuse: The same credential appears across unrelated workloads or environments.
• Dormant identities becoming active: A retired identity suddenly resumes activity.

In our case, the compromise was ultimately identified when the deployment account began accessing customer databases it had never previously touched, triggering a behavioral anomaly alert.

Behavioral monitoring becomes even more important as AI agents gain autonomy and interact with multiple applications, APIs, and cloud resources. Continuous detection monitoring helps security teams move beyond periodic audits by identifying risky machine identity behavior as it happens.

What happens when organizations miss the warning signs of a compromised NHI?

Recent supply chain incidents illustrate the consequences. In the widely publicized TJ-actions GitHub Actions compromise, attackers reportedly gained access to a bot account and used it to harvest secrets from CI/CD pipelines affecting more than 23,000 organizations. The attack targeted a non-human identity rather than a traditional user account.

The lesson extends far beyond GitHub. When attackers compromise a machine, every action appears authorized. Over several days, the account accesses secrets, enumerates cloud resources, and discovers additional credentials. By the time unusual activity is detected, the attacker has already expanded beyond the original environment.

The result can include data exposure, cloud compromise, software supply chain attacks, regulatory violations, and operational outages. As AI agents become more common, compromised machine identities may also influence business processes, automate malicious actions, or access sensitive information without immediate detection.

How can organizations detect compromised NHIs?

Detecting compromised NHIs requires intent-based security focused on three priorities: discovering identities, understanding risk, and enforcing continuous controls.

Discover every non-human identity

You cannot detect compromise in identities you do not know exist. Discovery must extend across service accounts, API keys, OAuth grants, Kubernetes workload identities, cloud roles, secrets, AI agents, and machine certificates. 78% of organizations don't have documented and formally adopted policies for creating or removing AI identities. The first step is identifying every deployment identity and its connected tokens, secrets, cloud roles, and machine identities across cloud, SaaS, and development environments.

Effective discovery extends beyond service accounts to include API keys, OAuth grants, Kubernetes workload identities, cloud roles, secrets, AI agents, and machine certificates. Yet governance often begins with incomplete visibility. According to recent research, 78% of organizations do not have documented, formally adopted policies for creating or removing AI identities. The first step is identifying every deployment identity and its associated tokens, secrets, cloud roles, and machine identities across cloud, SaaS, and development environments.

Understand permissions and blast radius

Knowing an identity exists is not enough. Security teams need visibility into its permissions, entitlements, connected systems, credential dependencies, and potential lateral movement paths.

A service account with access to 50 systems presents a very different risk profile than one with access to a single application. For the GitHub Actions account, that means mapping access relationships and determining whether a compromise could expose repositories, AWS accounts, secrets, or production systems.

Enforce continuous controls

Detection must lead to action. Leading teams continuously remove unnecessary permissions, rotate exposed credentials, disable unused identities, restrict risky OAuth grants, automate remediation, and govern AI agent access.

In our example, once anomalous behavior is detected, teams can rotate the stolen token, reduce permissions, disable unnecessary access paths, and contain the attack before it spreads further. Detection without enforcement simply produces more alerts.

Detecting compromised non-human identities in practice

Effective machine-first security starts with detection and depends on understanding normal behavior, reducing unnecessary access, and limiting blast radius.

Establish behavioral baselines

Document how machine identities normally operate and investigate deviations in access patterns, resource usage, and privilege consumption. In the 2026 SANS AI Survey, nearly half of practitioners identified behavioral detection as their most effective AI security control, followed by user awareness training (45%) and human analyst review (39%).

Reduce standing privileges

Limit the impact of compromise by enforcing least-privilege access and regularly removing unnecessary permissions.

Monitor third-party integrations

OWASP identifies vulnerable third-party NHIs as a major emerging risk category. Continuously review the identities, tokens, and permissions associated with external integrations.

Govern AI agent permissions

Every AI agent operates through one or more machine identities. Monitor agent permissions and ensure access remains aligned with intended tasks.

Review blast radius continuously

Understand what an attacker could access if a machine identity were compromised today, not what it was originally designed to access.

Continuous monitoring helps identify unusual database access, unexpected privilege use, and cloud resource enumeration before attackers reach sensitive systems.

How Token Security approaches detecting compromised non-human identities

Token Security applies intent-based security to continuously discover non-human identities, map permissions and trust relationships, analyze risk, and govern access as cloud and AI environments evolve.

The challenge

Traditional IAM and PAM platforms were designed for human users. They often lack the visibility needed to understand machine identities operating across cloud, SaaS, development, and AI environments.

In the GitHub Actions example, security teams need to identify connected identities, understand what they can access, and determine how far an attacker could move if a token were compromised.

The approach

• Discover: Identify GitHub Actions accounts and connected machine identities.
• Entitlement mapping: Map repositories, AWS roles, SaaS integrations, secrets, permissions, and trust relationships to understand what each identity can access.
• Understand risk: Analyze blast radius to reveal what an attacker could reach if a token is compromised.
• Respond: Detect anomalous behavior, privilege drift, and suspicious token activity. Automatically remove unnecessary permissions and rotate exposed credentials.
• Govern: Continuously enforce intent-based access as identities, permissions, and environments evolve.

The outcome

Organizations gain continuous visibility into machine identity risk, detect compromise earlier, reduce excessive access, and limit attacker movement before incidents can spread.

Real-world non-human identity detection success stories

Detecting compromised NHIs requires more than visibility. Security teams need insight that helps distinguish meaningful indicators from background activity.

Finding actionable machine identity risk

Lemonade needed visibility into machine identity exposure without overwhelming security teams with noise.

"Token Security has enhanced our security by providing us accurate and relevant visibility into machine identity risks, something I have yet to see from other vendors."

Detecting compromised NHIs begins with visibility. Security teams cannot identify unusual behavior, credential misuse, or excessive permissions if they cannot first see the identities operating in their environment.

Governing AI agents before they become blind spots

HiBob wanted visibility into custom GPT agents operating throughout its environment.

"Token Security gives us visibility we simply didn't have before. We can now automatically identify and control custom GPT agents running in our environment and ensure the required security level."

As organizations deploy more AI agents, governance increasingly depends on understanding the machine identities, permissions, and access relationships that power them. The consequences of falling short are already apparent. According to IBM's Cost of a Data Breach 2025 report, 97% of organizations that experienced an AI-related breach reported having no AI access controls in place.

Why non-human identities require a new security model

Machine identities now sit at the center of cloud infrastructure, software delivery pipelines, SaaS integrations, and AI workflows. But 61% of all cloud identities are unused or "zombies."

Attackers understand this reality. They increasingly target service accounts, OAuth tokens, CI/CD credentials, and AI-connected machine identities because those identities often possess broad access and limited oversight.

The compromise in our GitHub Actions example was not caused by a failed login. It was caused by a trusted machine identity accumulating access over time. The same pattern increasingly applies to service accounts, OAuth grants, AI agents, and cloud workloads across modern environments.

AI security ultimately depends on identity security. Every AI agent, automation workflow, and machine process operates through NHIs. Securing those identities is becoming one of the most important challenges in modern cybersecurity.