Dormant Cloud Credentials: Hidden Identity Risks Exposed by NHI Hound

Security researcher Aleksandr Krasnov has spotlighted a growing blind spot in cloud environments: dormant non-human identities (NHIs) that retain trust paths long after they should have been decommissioned. These ghost credentials, often tied to service accounts, automation tokens, API keys, and machine-to-machine workloads, can linger undetected within cloud platforms, silently expanding the attack surface. Because NHIs typically operate without human oversight, organizations frequently lose visibility into their permissions, making them prime targets for lateral movement and privilege escalation by adversaries. The risk is amplified when these stale identities inherit overly permissive roles or remain connected to critical resources without rotation.

To address the problem, Krasnov has released NHI Hound, an open-source tool engineered to map trust relationships across cloud identity providers and uncover forgotten credential paths. The tool analyzes role assignments, trust policies, and dependency chains to surface inactive or orphaned identities that could be exploited. According to Krasnov, the core issue is not just forgotten credentials, but the absence of automated mechanisms to evaluate which identities still serve a purpose. In modern multi-cloud and hybrid environments, where dozens of services spin up and down dynamically, manual auditing is no longer sufficient to track the lifecycle of machine identities.

The implications extend well beyond a single misconfigured service account. Attackers who discover or purchase leaked cloud credentials on dark web markets routinely leverage them to enumerate associated resources, pivot between environments, and exfiltrate sensitive data. Security teams should treat dormant NHIs with the same urgency as exposed user credentials, conducting regular audits of trust relationships and enforcing strict expiration policies. Practitioners can begin by validating which of their accounts may already be compromised using a email breach checker and by enforcing strong, unique secrets across machine identities with a password checker. Additionally, scanning externally exposed cloud endpoints with a port scanner can help identify forgotten services still authenticated by stale credentials. NHI Hound represents an important step toward closing the visibility gap, but the broader lesson is clear: in the cloud, every identity, human or otherwise, must be continuously governed.