Non‑Human Identities Make Up 91 % of Active Production Cloud Accounts, Raising Credential‑Compromise Risk
What Happened – A 2026 ClearVector Identity Intelligence Report, based on telemetry from AWS and Google Cloud, found that 91 % of identities active in production are non‑human (service accounts, execution roles, managed identities, and vendor credentials). Because these machine identities perform privileged actions (e.g., delete, terminate, create resources) and operate 24/7, a stolen credential can blend into normal traffic and be used for rapid, destructive activity. Recent incidents such as the Miasma supply‑chain compromise and the Mercor breach illustrate how attackers already exploit harvested cloud credentials.
Why It Matters for Compliance & Audit Readiness
- SOC 2 CC6 (Logical Access) expects documented controls over who can access production resources; unmanaged service‑account sprawl makes that control impossible to prove.
- Continuous‑compliance programs must capture real‑time evidence of non‑human identity activity to demonstrate “least‑privilege” and “monitoring” criteria during audits.
- The prevalence of machine credentials expands the attack surface, so evidence of credential‑rotation, secret‑management, and automated anomaly detection becomes essential audit artifacts.
Who Is Affected – Cloud‑first enterprises, SaaS platforms, DevOps teams, and any organization that runs workloads on AWS, Google Cloud, or similar public‑cloud environments.
Recommended Actions
- Inventory every service account, execution role, and vendor credential; map each to a business purpose and enforce least‑privilege permissions.
- Deploy automated secret‑rotation and short‑lived credential mechanisms (e.g., IAM roles with limited session duration).
- Integrate continuous identity‑access monitoring (e.g., anomalous API‑call detection, time‑of‑day baselines) into your SOC 2 evidence collection pipeline.
- Document policies for non‑human identity lifecycle management and include them in your audit readiness artifacts.
Source: Help Net Security – Non‑human identities are 91 % of everything active in production
Technical Notes – The report analyzed millions of API calls across AWS and GCP, finding that 99 % of human activity is read‑only, while 3 % of machine activity involves destructive actions. Third‑party credentials represent 4 % of the identity pool, yet a single security‑vendor identity performed 40 % of its calls as destructive operations. No specific CVE is cited; the risk stems from credential theft and misuse.