Contributor urges zero standing privilege for machine identities
Original title: The password nobody owns: Taking machines to zero standing privilege (ZSP)
A cited survey found 109 machine identities per human and 61% of privileged requests still standing.
A CSO Online contributor argues that rotating vaulted service-account passwords leaves their permissions intact between changes. The column cites Palo Alto Networks' 2026 Identity Security Landscape, based on more than 2,900 security leaders, and Entro Labs figures on credential age. It uses Google's account of UNC6395 abusing Salesloft Drift OAuth tokens against Salesforce in August 2025 as an example, then describes workload identity federation and near-zero standing privilege as the practical target.
Unconfirmed: The author says the 109-to-1 identity ratio should be treated cautiously because vendors count identities differently.
- Entro Labs found close to half of studied machine identities were over a year old.
- 7.5% of those identities had existed for five to ten years.
- Google said stolen Drift tokens were used from 8 to 18 August 2025.
- More than 700 organisations were caught up, according to the cited account.
- GitHub Actions can exchange an OIDC token for AWS credentials lasting about an hour.
- Products
- Salesforce
- Threat actors
- UNC6395
- Organizations
- Palo Alto NetworksEntro LabsSalesloft
From the original article
6 min read at csoonline.com
Ask your infrastructure lead who owns the service account behind the overnight finance batch and notice how long the answer takes. In many of the environments I’ve reviewed, the engineer who set it up left years ago and the password has been sitting in a vault, or sometimes a plain config file, ever since.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.