The breach began with a single unused service account no one remembered creating. By the time anyone noticed, code repos were cloned, and production secrets were gone. This is the reality of non-human identities and their zero day risk.
Non-human identities—service accounts, machine users, CI/CD bots, infrastructure tokens—outnumber human users in nearly every modern system. They are created by automation scripts, spun up by IaC templates, embedded into microservices. Once created, they often persist for years without rotation, scope review, or deletion.
This permanence makes them high-value zero day targets. Attackers know these credentials bypass MFA, rarely trigger anomaly alerts, and often have wide, unmonitored permissions. A single compromised API token can grant full access to source control, artifact registries, cloud resources, or production databases.
The zero day risk emerges when new exploits target systems or services tied to these machine identities before patches or mitigations exist. Even if you patch code, the tokens remain valid until intentionally revoked. In many environments, there is no real ownership model for these credentials. No one is tracking where they live, who created them, or when they should expire.