Non-human identities make up 91% of all active identities in production, according to ClearVector’s 2026 Identity Intelligence Report. This report, which analyzed data from AWS and Google Cloud environments, found that service accounts, execution roles, managed identities, and vendor credentials are the main types of identities in use.
These non-human identities are not just passive entities; they are actively engaged in various operations. A backup job may fire at 2 a.m., while a scanner may walk through the same AWS account an hour later.
A deployment pipeline may assume a role at 4 a.m., and a logging agent may run continuously throughout the night. They perform tasks that are essential to the operation of the system.
Security Implications
Each of these actions carries a credential issued to a machine, which can be exploited by attackers. If an attacker gains access to one of these credentials, they can inherit the same cover as the legitimate machine identity.
This makes it challenging for defenders to detect malicious activity, as a rogue API call at 3 a.m. can blend in with normal traffic. The researchers found that attackers have already taken advantage of this vulnerability.
In June 2026, stolen credentials and trusted publishing workflows were used to push malicious packages through Red Hat’s legitimate channels in the Miasma compromise. Similarly, a compromise of the LiteLLM project led to the Mercor breach two months earlier.
Identity Intelligence Report Findings
The ClearVector report found that only 20% of non-human activity in production occurs during standard business hours. This means that a significant portion of machine activity happens outside of regular working hours, making it harder to detect anomalies.
Human sessions in production are mostly read-only, with 99% of observed human activity consisting of Describe, List, Get, and similar calls. They rarely make changes to the system.
Related: AI rivals unveil competing voice features
Machine identities, on the other hand, have a different profile. Delete and terminate calls account for 3% of non-human activity, with privileged create-and-modify operations adding a few points on top.
A compromised service account can execute at machine speed and volume, making it a significant threat. It can cause a lot of damage in a short amount of time.
Third-party credentials make up 4% of the identity population, but they can still pose a significant risk. The top four vendor identities each reached across the entire production environment, spanning multiple regions and services.
One security vendor’s credentials were found to have spent 40% of their observed calls on destructive actions. This highlights the importance of monitoring and controlling third-party access.
Weekend Traffic Patterns
Weekend traffic remains a relatively quiet period, with activity staying under 5% of total traffic across every identity type. A Saturday surge can still stand out without any modeling behind it, providing a potential opportunity for defenders to detect anomalies.
A backup job that runs at 2 a.m. every night is easy to model, but catching the night it runs twice depends on someone having kept the first one on file. The report emphasizes the importance of monitoring and analyzing machine activity to detect potential security threats.
None of the existing tools can determine whether a specific identity’s behavior is legitimate. The identity provider confirms who authenticated, and the cloud posture tool confirms the configuration, but they cannot detect malicious activity. This limitation highlights the need for more advanced security control systems to protect against compromised machine identities.
