NHIs Now the Number One Corporate Entry Point for Hackers

Compromised non-human identities (NHIs) including AI agents are nearly twice as likely to be a primary entry point into the enterprise than phishing, a new study from SpyCloud has claimed.

The threat protection firm’s SpyCloud Identity Threat Report is based on a survey of 750 cybersecurity leaders and practitioners at organizations with 500+ employees in North America the UK, Spain, Germany, the Netherlands, Austria and Switzerland.

It revealed that NHIs such as AI agents, service accounts, API keys and authentication tokens accounted for 31% of intrusions, versus 17% for social engineering.

Read more on NHIs: Governance Gaps Emerge as AI Agents Drive 76% Increase in NHIs.

The findings are particularly concerning given that, while most (95%) organizations think they have adequate visibility into NHIs, only 36% actually monitor them. SpyCloud said this makes machine identities the least-watched category of identity risk studied.

Some 68% of respondents said they suffered an identity-based event in the reporting period, with NHI-related misuse at 42%.

While NHIs are often granted elevated privileges, they frequently don’t get offboarded, and related credentials aren’t rotated, making them a persistent security risk, SpyCloud claimed.

"That asymmetry is what attackers are exploiting," said Trevor Hilligoss, SpyCloud's chief intelligence officer. "Every one of these identities is a standing invitation that renews itself until someone notices."

Governance, Blind Spots and Supply Chain Exposure

Elsewhere, the report revealed a mismatch between AI governance and adoption. While nearly all responding organizations said they use AI tools or agents which have access to internal systems, applications, or data, only 56% claimed to have formal processes in place to govern their privileges.

Two-fifths (41%) said they rely on informal processes or partial ownership.

Visibility into identity-related risk was highlighted as a critically important part of maintaining a good security posture, the report also found.

Organizations that had insight into stolen session cookies experienced identity-based events at a significantly lower rate (37%) than those that could not (50%).

Malware-infected third-party devices (23%) and exposed API keys or application access involving vendors and partners (22%) were the main causes of supply chain identity events, respondents claimed.

However, nearly two-fifths admitted to not having a consistent process in place to confirm third-party identity exposure. That’s despite a third (32%) claiming that they will focus on supply chain risk management over the coming 12-18 months.

Hilligoss argued that organizations can’t afford to leave any part of the attack surface unmanaged.

"Every control that works pushes attackers toward what it doesn't cover. We hardened passwords, so they targeted sessions; we tightened employee accounts, so they looked to service accounts and vendor connections," he said.