Dormant Cloud Identities Can Create Hidden Security Exposure, Researcher Warns

Security researcher Aleksandr Krasnov is drawing attention to the risks posed by dormant non-human identities (NHIs) in cloud environments. These identities include service accounts, application credentials, automated workloads and other machine-to-machine access mechanisms that operate without direct human interaction.

Although an inactive credential may appear harmless, it can remain connected to cloud resources, applications or other identities. That persistence can make it difficult for security teams to understand which access paths still exist and what an attacker might be able to reach if a credential is compromised or reactivated.

Visibility gaps in machine identities

Organizations commonly focus identity reviews on employee accounts, while automated identities can receive less scrutiny. NHIs may be created for temporary projects, testing or integrations and then left behind when their original purpose ends. Over time, these unused accounts and permissions can become part of a broader, difficult-to-map trust relationship.

Krasnov describes these dormant identities as a source of security blind spots. The concern is not limited to whether a credential is currently being used; its permissions and relationships with other systems may also determine the potential impact of unauthorized access.

Open-source discovery tool

To help investigate these relationships, Krasnov has released NHI Hound, an open-source tool designed to identify trust paths associated with non-human identities. The tool is intended to help defenders locate connections that may otherwise be missed during conventional account and permission reviews.

Security teams assessing the issue can begin by maintaining an inventory of machine identities, confirming ownership and purpose, and removing credentials that are no longer required. They can also review permissions for excessive access, monitor activity involving dormant accounts and use short-lived credentials where practical.

Tools such as NHI Hound may support this process, but discovery is only one part of identity security. Findings still need to be validated against business requirements, and remediation should be planned carefully to avoid disrupting legitimate automation or cloud services.