Machine identities outnumber human users in enterprise cloud environments by at least ten to one. Service principals, CI/CD runner tokens, cross-account IAM roles, and automated backup service accounts proliferate across infrastructure quietly. Nobody deletes them when projects retire. They sit dormant for months or years, retaining high-privilege access to sensitive workloads.
When security teams audit access management, human user accounts get most of the attention. Password rotation rules, multi-factor authentication enforcement, and single sign-on dashboards focus almost entirely on human logins. Meanwhile, a single forgotten API key sitting in an abandoned repository can grant administrative control over multi-cloud environments. That imbalance makes non-human identity (NHI) sprawl one of the fastest-growing cloud attack vectors today, as detailed in recent reporting on cloud attack paths from non-human identity sprawl.
The Silent Sprawl of Machine Identities
Modern microservices, continuous integration pipelines, and SaaS platforms depend on machine-to-machine trust. Every microservice deployment, serverless function, or automated reporting script requires permission tokens. Over time, development velocity creates an administrative imbalance: software creates credentials at machine speed, but security teams review them at human speed.
This sprawl extends far beyond public cloud providers like AWS or Azure. Enterprise resource planning systems introduce complex access layers, making erp software security a critical focal point when legacy machine accounts connect directly to core financial databases. Backup appliances and infrastructure management tools similarly require high-level credentials; deploying a security & compliance analyzer veeam setup often involves provisioning long-lived service keys with elevated storage access. Meanwhile, within productivity ecosystems, app registrations and automated OAuth connectors inside the security & compliance center office 365 environment often remain active long after third-party integrations are abandoned.
The result is an ecosystem littered with ghost credentials—dormant API tokens, unrotated service keys, and forgotten OAuth grants. Because these non-human identities lack human owners to reset passwords or notice suspicious behavior, compromised machine keys can go unnoticed for hundreds of days, creating severe risk during third-party supply-chain breaches.
Mapping Trust Graphs with NHI Hound
To eliminate these blind spots, a security & compliance analyst cannot rely on simple spreadsheet inventories. They need graph-based visualization and automated analysis capable of tracking chained privileges across platforms.
An emerging open-source tool addressing this challenge is NHI Hound, a CLI utility developed by security researcher AlekKras for Black Hat 2026. Built on Python 3.12+ and using NetworkX for graph modeling, NHI Hound ingests JSON inventories of identities and trust relationships to build directed attack graphs.
Instead of evaluating permissions in isolation, NHI Hound analyzes how credentials relate to one another. Its core workflow starts with simple inventory validation and extends to full graph generation:
## Validate inventory reference integrity
nhi-hound validate inventory.json
## Analyze top risk identities and blast radius metrics
nhi-hound analyze inventory.json --top 10
## Export interactive PyVis graph visualization
nhi-hound graph inventory.json -o output/trust_graph.html
The generated HTML graph visualizes complex cloud trust structures clearly. Nodes represent system entities, color-coded by platform (AWS, Azure, GCP, GitHub, or SaaS). Node shapes distinguish object types—circles represent identities, diamonds represent credentials, and boxes represent resources. Crucially, node sizes scale dynamically based on calculated blast radius, allowing analysts to instantly pinpoint highly connected credentials capable of exposing vast portions of the environment.
Simulating Multi-Hop Attack Trajectories
Identifying high-risk service accounts is only step one. Security teams must understand how an attacker can leverage a low-privilege entry point to pivot toward mission-critical systems.
When an attacker compromises a minor service principal—such as a billing service principal (sp-billing)—they rarely find full administrative access immediately. Instead, they hop between intermediate roles and trust relationships (has_role). NHI Hound automates the enumeration of these multi-hop trajectories:
## Enumerate top attack paths originating from a compromised account
nhi-hound paths inventory.json --from sp-billing --max-depth 5 --limit 20
To take analysis further, NHI Hound includes a deterministic attack simulation engine. By executing nhi-hound simulate --from sp-billing --target role-admin, security analysts can replay an attack step-by-step. The engine outputs precise data at each hop:
- Initial Compromise: Identifies the compromised entry credential.
- Traversed Trust Relationships: Maps the exact permission edge traversed (such as cross-account role assumption or token exchange).
- Newly Reached Identities: Lists newly accessible resources and identities.
- Privilege Gained: Quantifies incremental permissions acquired at each step.
- Cumulative Blast Radius: Recalculates total potential exposure after every hop.
Simulating these attack paths reveals non-obvious choke points where revoking a single intermediate trust edge breaks an entire chain. This proactive approach complements broader defensive research into cloud exposure, including studies on autonomous AI attack vectors.
Uncovering Implicit Trust Edges
Explicitly documented permissions only represent a fraction of real-world machine trust. In practice, non-human identities often maintain implicit trust edges derived from configuration metadata, hardcoded environment variables, or shared key vaults.
NHI Hound solves this discovery gap using its discover-trust engine. By evaluating identity and resource metadata, the tool infers unrecorded trust relationships and appends them to an augmented inventory:
## Infer trust edges using balanced strictness and a custom confidence threshold
nhi-hound discover-trust inventory.json --strictness balanced --min-confidence 0.72 -o inferred_inventory.json
Analysts can adjust strictness settings (strict, balanced, or broad) depending on how conservatively they wish to evaluate metadata. Every inferred edge produced by the tool carries explicit audit metadata:
inferred=true: Flags the edge as algorithmically discovered rather than explicitly declared.inference_rule: Identifies the specific heuristic rule that triggered discovery.reason: Provides a human-readable explanation of why the trust edge exists.confidence: Assigns a numerical confidence score between 0.00 and 1.00.
This inference capability is vital when auditing hybrid setups. For instance, legacy integrations inside 365 enterprise tenants or complex ERP software security environments frequently rely on implicit service bindings that traditional IAM tools overlook.
Standardizing Machine IAM Governance
Visualizing attack graphs and inferring hidden trust edges provides deep tactical visibility, but enterprise security requires standardized governance frameworks to maintain long-term security & compliance posture.
Industry standards are evolving rapidly to address non-human identity risks. The OWASP Non-Human Identities Top 10 project establishes a formal taxonomy for machine identity vulnerabilities, highlighting critical risks such as ghost credentials, over-privileged tokens, and unmonitored machine movement.
Simultaneously, governance frameworks like the Cyber Strategy Institute's AI-SAFE2 Framework provide strategic structure for managing non-human identity security alongside autonomous AI workloads. As software agents and automated pipelines gain greater operational autonomy, GRC frameworks must treat machine credentials with the same rigorous lifecycle management previously reserved for human identities.
To close security blind spots effectively, security analysts should adopt a four-part operational rhythm:
- Continuous Inventorying: Regularly export and consolidate non-human identity inventories across cloud providers, SaaS, and internal systems.
- Metadata Trust Discovery: Run trust inference tools to reveal implicit edges hiding in enterprise configurations.
- Deterministic Simulation: Replay multi-hop attack paths routinely to test identity boundary strength before adversaries exploit them.
- Lifecycle Enforcement: Enforce strict lifetime limits, automatic secret rotation, and immediate revocation of dormant service credentials to guard against automated exploit chaining.
By shifting focus from static human access reviews to dynamic, graph-based machine identity governance, enterprise security teams can neutralize ghost credentials before they turn into critical cloud breach vectors.