Non-human identity attack surface

ManySignal monitors: service accounts (AWS IAM, GCP service accounts, Entra ID service principals), API keys and tokens (GitHub PATs, Slack bot tokens, Stripe keys), OAuth 2.0 clients and grants, CI/CD pipeline identities (GitHub Actions OIDC, Jenkins credentials), Kubernetes service accounts, and AI service accounts and API credentials. All are profiled for behavioral baselines.

Service account credentials used from unexpected locations (IP geolocation outside cloud provider ranges), unusual times, or at unusual rates are flagged against the service account's behavioral baseline. API keys used from residential IPs or Tor exit nodes are immediately escalated. ManySignal also monitors for the same credentials being used simultaneously from multiple geographic regions — a strong indicator of compromise.

ManySignal builds a real-time catalog of all non-human identities discovered across cloud, SaaS, and on-premise environments. Each identity is assessed for: last use date, permissions scope vs. actual usage, credential age, and whether an owner is registered. Orphaned service accounts (no activity in 90 days, no identified owner) are surfaced for remediation.

Yes. ManySignal compares the permissions granted to each service account against the permissions actually exercised over the past 90 days. Service accounts with a large delta (granted administrator access, uses only read operations) are flagged as over-privileged. ManySignal suggests the minimal permission set based on observed usage and can trigger IAM right-sizing workflows.

When a non-human identity credential is confirmed compromised, ManySignal's response workflow can trigger automatic rotation (where the issuing service provides a rotation API — AWS IAM, GitHub, Twilio, Stripe) or generate a step-by-step rotation runbook for credentials requiring manual rotation. The old credential is revoked as part of the same workflow. All rotation actions are logged with timestamps to the case evidence package.

Yes. Vendor and third-party service accounts (integration partners, SaaS vendors with API access, managed service providers) are tracked in the entity graph with their permission scope and historical access patterns. Anomalous activity from vendor accounts — access outside contracted hours, resource access outside the vendor's service scope, unusual API call volumes — fires the same detection pipeline as internal service accounts.

ManySignal's NHI inventory covers the key lifecycle events NIST SP 800-207 and the emerging NHI security guidance address: creation (discovery of new service accounts), access review (permission scope vs. usage comparison), credential aging (keys older than policy rotation window), and decommissioning (orphaned accounts with no owner or recent activity). Evidence of lifecycle management processes is exportable for auditor review.

Initial NHI discovery completes within 24 hours of connecting cloud providers, identity providers, and SaaS platforms. The inventory covers API keys, OAuth grants, service accounts, and CI/CD pipeline credentials discovered via API enumeration. Credentials that don't appear in discovery (such as hardcoded secrets in application code) are surfaced via integration with secret scanning tools. A complete, baseline-calibrated inventory is typically ready within the first week.