Tag: Non-Human Identities

  • SpyCloud Report: Non-Hhuman Identities Emerge as Leading Enterprise Attack Vector

    SpyCloud Report: Non-Hhuman Identities Emerge as Leading Enterprise Attack Vector

    Survey Reveals Critical Gap Between Perceived and Actual Visibility into Machine Identities

    SpyCloud, a leader in identity threat protection, has released its annual 2026 Identity Threat Report, revealing that non-human identities (NHIs) — including AI agents, service accounts, API keys, and authentication tokens — have become the most common initial attack vector into enterprise systems. The report, based on a survey of 750 cybersecurity leaders and practitioners across North America, the UK, and select European markets, underscores a dangerous disconnect: while 95% of organizations believe they have adequate visibility into AI- and NHI-related exposures, only 36% actually monitor these identities.

    Key Findings: NHIs Outpace Phishing as Top Entry Point

    The survey found that compromised NHIs were the primary entry point for attacks in 31% of cases — nearly double the rate of phishing and social engineering (17%), which ranked second. NHI-related misuse also surfaced as the most common identity-based event type, reported by 42% of organizations. Yet, despite this prevalence, machine identities remain the least-monitored category of identity risk. In the same period, 68% of organizations experienced at least one identity-based event, with affected organizations averaging eight incidents each.

    Organizations typically maintain clear inventories of their human workforce, but few extend that oversight to service accounts, API keys, and AI agents. These identities are often provisioned for convenience, hold substantial privilege, and lack the lifecycle management that human accounts have. As Trevor Hilligoss, SpyCloud’s Chief Intelligence Officer, noted: “Every one of these identities is a standing invitation that renews itself until someone notices.”

    AI Adoption Outpaces Governance

    While 91% of organizations now use AI tools or agents with access to internal systems, only 56% have formal governance and ownership for the privileges these identities hold. Another 41% rely on informal processes or partial ownership, creating “shadow access” — privileged connections that operate outside normal governance and monitoring.

    Session Hijacking and Stolen Cookies Pose Growing Risk

    The report highlights that exposed session cookies and authentication tokens are becoming a preferred attack vector, allowing cybercriminals to bypass multi-factor authentication (MFA). Organizations with visibility into stolen session data experienced identity-based events at a meaningfully lower rate (37%) compared to those without such visibility (50%). SpyCloud research confirms that session data has now overtaken passwords as the top target for attackers.

    Supply Chain Vulnerabilities Remain a Concern

    Third-party exposures are also a major concern. Malware-infected third-party devices (23%) and exposed API keys or application access involving vendors (22%) were the leading causes of supply chain identity events. Surprisingly, nearly 40% of organizations have no consistent process to confirm that third-party exposures are fully resolved, even as 32% plan to enhance supply chain and vendor risk management in the next 12 to 18 months.

    Automation and Continuous Monitoring Are Key Differentiators

    The report introduces SpyCloud’s Identity Threat Protection Maturity Model, categorizing organizations into four tiers: Reactive, Building, Operational, and Optimized. Findings show that organizations with high levels of automation report lower incident response costs (32% vs. 39%) and less loss of customer trust (36% vs. 47%) compared to those relying on manual remediation.

    “Most identity programs are still measured on whether an exposure happened. That’s the wrong scoreboard,” said Damon Fleury, Chief Product Officer at SpyCloud. “Organizations that pair continuous identity monitoring with automated remediation create the greatest friction for criminals and gain the biggest edge in preventing follow-on attacks.”

    About the Report

    The full 2026 SpyCloud Identity Threat Report is available without registration, and organizations can benchmark their security posture against the maturity model via a free assessment. SpyCloud, headquartered in Austin, TX, serves 7 of the Fortune 10 and hundreds of global enterprises, mid-sized companies, and government agencies.

    This is a paid press release published via CyberNewswire, a PR newswire syndication platform for cybersecurity companies.

  • Saviynt Surpasses $300M ARR and Introduces Zuma, an AI-Powered Identity Security Platform

    Saviynt Surpasses $300M ARR and Introduces Zuma, an AI-Powered Identity Security Platform

    Saviynt, a leading provider of identity security solutions, has announced a major milestone: surpassing $300 million in annual recurring revenue (ARR) while growing bookings by more than 80% and maintaining a 96% customer retention rate. Alongside these financial achievements, the company launched Zuma, a comprehensive AI identity security platform designed to help organizations adopt, deploy, and scale AI solutions with confidence.

    Why Zuma Matters in the Age of AI

    The rapid adoption of AI has introduced new security challenges. AI agents, large language models (LLMs), AI-based applications, and non-human identities are multiplying across business functions, often without effective oversight. Legacy identity solutions, misapplied cybersecurity tools, and broad IT systems cannot keep pace. Zuma addresses these gaps by providing a unified control plane that combines AI-specific capabilities with established identity best practices.

    “AI is fundamentally changing the identity security equation,” said Sachin Nayyar, CEO of Saviynt. “Enterprises are no longer securing only human users. They are now responsible for AI agents and non-human identities that can decide and access systems at machine speed. Saviynt’s momentum reflects the urgency we are seeing from customers around the world, and Zuma represents a major step forward in helping them embrace AI with confidence and control.”

    Zuma’s Three Core Components

    Zuma is built around three integrated modules:

    • Zuma Insights – Provides full visibility into all identities, continuously discovering AI agents, LLMs, AI-based applications, and non-human identities. It tracks what these identities access, who owns them, lifecycle changes, and risk exposure.
    • Zuma Access – Enforces run-time protection by evaluating agent intent, context, permissions, and risk. It prevents privilege misuse and anomalous activity before it impacts the business.
    • Zuma Governance – Ensures accountability through ownership, lifecycle controls, policy guardrails, access reviews, and audit-ready evidence for AI and non-human identities.

    “Customers are telling us they need more than another dashboard,” added Nayyar. “They need a control plane that can help them see every AI and non-human identity, govern it with accountability, and protect the business in real time. That is the problem Zuma was built to solve.”

    Customer Perspective

    Sarita Dsouza, IAM Leader at Cytiva (a Danaher company), noted: “Like many large enterprises, we are looking at how to safely scale AI across the business without losing visibility or control. The challenge is that AI agents and non-human identities don’t fit neatly into legacy identity processes. Saviynt is bringing the right pieces together – discovery, ownership, runtime controls, and governance – in a way that maps to how security teams actually need to manage this risk.”

    Availability

    Zuma is available now. Organizations can learn more, watch a demo, and start a free trial at the Saviynt website.

    About Saviynt

    Saviynt is the identity security platform built to secure the modern enterprise. With Zuma, its complete AI identity security platform, Saviynt helps organizations build, run, and scale AI with confidence. The world’s leading brands trust Saviynt to reduce risk, improve visibility, and support compliance while enabling business agility. For more information, visit www.saviynt.com.

  • Mastering Identity Lifecycle Management: Key Phases, Best Practices, and Essential Tools

    Mastering Identity Lifecycle Management: Key Phases, Best Practices, and Essential Tools

    Identity lifecycle management governs how access is provisioned, maintained, changed, and revoked for both human and non-human identities. It is a core access control function because lifecycle events determine who—or what—can reach applications, data, infrastructure, and privileged functions. When lifecycle controls are weak, organizations accumulate stale entitlements, delayed deactivation, excessive privileges, orphaned accounts, unmanaged credentials, and other access paths that expand security exposure.

    How Identity Lifecycle Management Works

    Identity lifecycle management keeps access aligned to verified business need. It connects identity data, policy decisions, workflow execution, and enforcement across the identity and access management (IAM) lifecycle. Lifecycle management acts as an enforcement layer, determining who or what can access critical systems, under which conditions, for how long, and with which governance requirements.

    Identity Data Sources and Authoritative Systems

    Authoritative identity data determines whether lifecycle decisions are accurate. Human resources systems, contractor platforms, directories, cloud identity providers, configuration management databases, DevOps platforms, and SaaS applications can all provide signals that define identity status, ownership, role, and access eligibility.

    • Employees: Lifecycle events usually originate in HR records, including hiring, transfer, leave, or termination status.
    • Contractors: Status, ownership, and end dates may come from contractor management platforms, vendor records, or procurement systems.
    • Non-human identities: Service accounts, API keys, machine credentials, OAuth tokens, and autonomous AI agents often depend on weaker ownership records and may require separate discovery and inventory controls.

    Policy-Driven Access Requests, Approvals, and Fulfillment

    Policy-driven provisioning grants access based on verified need rather than convenience, precedent, or unmanaged exceptions. Requests should be evaluated against role, attributes, risk, segregation-of-duties rules, data sensitivity, business justification, and time limits. Identity lifecycle management tools route requests through standard approvals, enforce policy before fulfillment, and retain evidence for each decision. Less-controlled models rely on email approvals, manual tickets, and inherited permissions, which can create privilege sprawl over time.

    Continuous Monitoring and Lifecycle Automation

    Lifecycle control does not end after provisioning. Access must stay accurate as identities move across roles, projects, locations, employment status, ownership structures, and technology environments. Continuous monitoring compares current entitlements with current identity attributes and policy requirements. Automation can trigger remediation when access no longer matches verified need, reducing the time between business change and access correction.

    Key Phases of Identity Lifecycle Management

    Identity lifecycle management phases are event-driven control points. Hiring, onboarding, role changes, project assignments, emergency access, separations, ownership transfers, and system decommissioning should each trigger access decisions. Every identity is a potential access path, and every access path is part of the enterprise attack surface. Lifecycle management helps keep access intentional, current, and defensible.

    Joiner Phase: Onboarding and Birthright Access

    The joiner phase establishes the initial access baseline. Employees, contractors, service accounts, bots, and workload identities should receive only the entitlements required for their role, function, environment, and approved business purpose. Birthright access needs close governance because it becomes the foundation for future privilege accumulation. Programs should define access using role-based, attribute-based, and policy-based models instead of copying peer permissions or granting broad defaults.

    Mover Phase: Role Changes and Access Adjustments

    The mover phase is where privilege sprawl often becomes permanent. Promotions, department transfers, project additions, temporary grants, emergency privileges, and geographic changes can all affect whether existing entitlements remain valid. Access granted for a previous responsibility should not persist after the business need expires. Lifecycle workflows should remove outdated access as part of the same event that provisions new access.

    Leaver Phase: Offboarding and Access Revocation

    The leaver phase covers deactivation, revocation, credential invalidation, and access path closure. Separations, contract endings, vendor exits, workload retirements, and service decommissioning should trigger timely and complete access removal. Controls should disable accounts, revoke active sessions where supported, remove group memberships, rotate shared secrets, invalidate tokens, and preserve evidence that deactivation occurred within required service-level targets.

    Benefits of an Effective Identity Lifecycle Management Solution

    An effective identity lifecycle management solution reduces exposure by making access decisions faster, more consistent, and easier to audit. It turns identity changes into controlled actions across directories, SaaS platforms, cloud services, databases, infrastructure, and privileged access systems. The value is governance at scale: access stays aligned to verified need, while exceptions become visible, time-bound, and reviewable.

    Reduced Security Risk and Least-Privilege Access

    Least privilege depends on lifecycle accuracy. If access is not removed when roles change or identities leave, least privilege cannot be enforced. Lifecycle controls use policy, automation, and access analytics to identify excessive entitlements, toxic combinations, dormant accounts, and high-risk privilege assignments. Stale permissions should be treated as exposure conditions that require review, remediation, or documented acceptance.

    Faster Onboarding, Productivity, and Operational Efficiency

    Lifecycle automation reduces delay without removing control. New identities can receive approved access quickly because policy, approvals, and fulfillment run through repeatable workflows. Well-integrated identity lifecycle management tools reduce manual service-desk work, limit repetitive provisioning tasks, and prevent speed from depending on governance bypasses.

    Audit Readiness and Compliance Evidence

    Regulated environments require evidence that access is appropriate, approved, reviewed, and revoked on time. Lifecycle management provides the control record behind those assertions. A mature program can show who approved access, why it was granted, when it changed, how it was fulfilled, and when it was removed. That evidence supports internal policy, external regulation, contractual commitments, and security assurance obligations.

    Identity Lifecycle Management Challenges

    Identity lifecycle management breaks down when identity data, application ownership, workflow execution, and enforcement systems are fragmented. The result can be inconsistent access, incomplete revocation, weak accountability, and poor visibility into who or what can reach sensitive assets. The operational requirement is straightforward: every identity needs an owner, every entitlement needs a purpose, and every access path should be justifiable when inspected.

    Disconnected Applications and Incomplete Identity Data

    Disconnected applications create unmanaged access islands. When systems sit outside centralized provisioning and deprovisioning, lifecycle decisions depend on local administrators, manual updates, and inconsistent evidence. Incomplete identity data makes the problem worse. If role, manager, employment status, asset ownership, or application entitlement data is inaccurate, automation can accelerate flawed decisions. Data quality should be addressed before automation is expanded.

    Excessive Privileges, Orphaned Accounts, and Shadow Access

    Excessive privileges often emerge gradually. A project grant remains after delivery, a temporary admin role becomes permanent, a contractor account survives contract expiration, or a service account loses its owner after a team reorganization. Shadow access is difficult to govern because it sits outside normal access management processes. Programs need continuous discovery of accounts, credentials, tokens, groups, and entitlements across managed and unmanaged systems.

    Balancing Automation, Governance, and User Experience

    Automation without governance can provision risky access at scale. Governance without automation creates delays that may lead to workarounds, shared accounts, and unauthorized access paths. Risk-based workflows help balance both needs. Low-risk, policy-compliant access can be fulfilled automatically, while privileged, sensitive, or unusual access requires stronger approval, time limits, justification, and post-grant review.

    Non-Human Identity Lifecycle Management

    Non-human identity lifecycle management is now a central enterprise security requirement. Service accounts, API keys, machine credentials, OAuth tokens, bots, workloads, containers, scripts, CI/CD identities, and autonomous AI agents often hold persistent access to sensitive systems. In many environments, these identities outnumber human identities and change more often. When unmanaged, they create durable access paths that are hard to attribute, revoke, and monitor.

    Service Accounts, API Keys, Bots, and Machine Identities

    Non-human identities support automation, integration, workload execution, and system-to-system communication. Their risk profile differs from human identities because they often run continuously, authenticate without interactive controls, and rely on secrets that may be copied, embedded in code, or forgotten. Programs should classify non-human identities by function, owner, environment, privilege level, credential type, and business criticality. An API key used in production payment processing requires different governance than a temporary test token in a sandbox.

    Ownership, Rotation, and Credential Lifecycle Controls

    Ownership makes non-human identities governable. Every service account, machine identity, token, and autonomous agent should have a business owner, technical owner, approved purpose, expiration logic, and revocation path. Credential lifecycle controls reduce persistence risk. These controls include rotation, vaulting, scoped privileges, short-lived credentials where supported, certificate renewal controls, secret scanning, and automated deactivation when workloads or integrations are retired.

    How an Identity Security Platform Governs Non-Human Identities

    An identity security platform extends lifecycle governance beyond employees and contractors. It discovers non-human identities, maps them to owners and assets, evaluates entitlements, and enforces policy across hybrid infrastructure, cloud environments, SaaS applications, and DevOps pipelines. Non-human identities should be treated as first-class security subjects. Governance should include access certification, anomaly detection, credential hygiene, entitlement analysis, and automated remediation when a machine credential, OAuth token, or AI agent exceeds its approved scope.

    Best Practices for Managing the Identity and Access Management Lifecycle

    Managing the identity and access management lifecycle requires a structured operating model. Policies, ownership, automation, access reviews, and metrics must work together so lifecycle decisions stay accurate at enterprise scale. The objective is not simply to manage accounts. The objective is to govern exposure by ensuring every entitlement reflects current, verified need and every lifecycle event produces timely access correction.

    Define Ownership, Policies, and Role-Based Access Models

    Ownership and policy design determine whether lifecycle management can scale. Without clear accountability, access reviews become procedural exercises, and remediation becomes inconsistent.

    • Identity ownership: Each human and non-human identity should have an accountable owner responsible for legitimacy, access needs, and lifecycle status.
    • Access models: Role-based, attribute-based, and policy-based access models should define standard entitlement patterns and reduce ad hoc grants.
    • Exception handling: Exceptions should be justified, risk-scored, time-bound, and reviewed before they become permanent exposure.
    • Application accountability: Application owners should validate entitlement meaning, sensitivity, and revocation behavior.

    Automate Provisioning, Deprovisioning, and Access Reviews

    Automation gives lifecycle controls the speed required to match business change. Manual execution often cannot keep pace with hiring, transfers, project churn, cloud expansion, and non-human identity growth.

    1. Event capture: Lifecycle events should originate from authoritative systems such as HR, contractor platforms, ITSM, CMDB, cloud control planes, and DevOps tooling.
    2. Policy evaluation: Access decisions should be checked against role, attributes, risk, segregation-of-duties constraints, and data sensitivity.
    3. Workflow execution: Approved access should be provisioned through controlled connectors, APIs, or orchestration workflows with full logging.
    4. Revocation action: Access removal should disable accounts, remove entitlements, revoke sessions where supported, invalidate credentials, and confirm completion.
    5. Review cadence: Access reviews should be targeted by risk, privilege level, application criticality, and lifecycle event history.

    Measure Maturity Across the Identity Management Lifecycle

    Measurement separates governed lifecycle management from routine administration. Security leaders need metrics that show whether access is correct, excessive, delayed, or unowned.

    • Provisioning speed: Time from approved request to completed access fulfillment.
    • Deactivation latency: Time from separation, retirement, or ownership change to complete revocation.
    • Privilege reduction: Volume of excessive, dormant, or toxic entitlements removed.
    • Review effectiveness: Percentage of access reviews resulting in meaningful remediation.
    • Coverage depth: Percentage of applications, cloud services, and non-human identities under lifecycle governance.
    • Exception aging: Number and age of temporary grants, emergency privileges, and policy exceptions.

    Identity lifecycle management defines how tightly the enterprise access surface is controlled. Programs that combine lifecycle automation, authoritative data, and governance discipline reduce privilege sprawl, close stale access paths, and maintain defensible control over human and non-human identities.