Orphaned Identities Fueling Cloud Breaches: The Unseen Threat

Forget phishing and weak passwords for a moment. According to The Hacker News, a staggering 68% of cloud breaches in 2024 were directly linked to compromised service accounts and forgotten API keys. This highlights a critical, often overlooked vulnerability: unmanaged non-human identities. These automated credentials, including service accounts, API tokens, AI agent connections, and OAuth grants, vastly outnumber human employees – often by a factor of 40 to 50 per person.

The problem escalates when projects wrap up or employees depart. These automated identities, no longer tied to active personnel or projects, can become orphaned. Without proper oversight, they linger in the environment, providing potential entry points for attackers. The Hacker News points out that these forgotten digital keys are a prime target, often left unmonitored and ripe for exploitation.