As Non-Human Identity Attacks Soar, Cloud Security Alliance and Astrix Security Reveal Critical Gaps in Non-Human Identity Protection

New data shows that one in five organizations have experienced a security incident related to non-human identities; and only 15% remain confident in their ability to secure them

Seattle - September 12, 2024 - The Cloud Security Alliance (CSA), the world’s leading organization dedicated to defining standards, certifications, and best practices to help ensure a secure cloud computing environment, and Astrix Security, the enterprise's trusted solution for securing non-human identities, today announced first of its kind research that sheds light on the current state of non-human identity (NHI) security. Findings from the State of Non-Human Identity Security Survey Report, a survey of more than 800 experts coupled with data from more than 2 million monitored NHIs in Fortune 500 companies, reveal a significant security disparity: organizations are far less equipped to secure non-human identities compared to their human counterparts. The most common challenges include service account management and NHI discovery. Though the survey also revealed there is a growing recognition of the importance of investing in NHI security with 1 in 4 organizations already investing in these capabilities and an additional 60% planning to within the next 12 months.

"NHIs – like bots, API keys, service accounts, OAuth tokens, and secrets – are all lifelines of today’s organizations, enabling automation, efficiency, and innovation," said John Yeoh, Global VP of Research at CSA. "And while organizations recognize the importance of securing NHIs and often deploy a mix of tools like Identity Access Management systems, these tools are not specifically tailored to the unique challenges that NHIs present. The mismatch is evident in recent attacks on major brands like AWS, Okta, Cloudflare, and Microsoft, where despite having security measures in place, hackers still managed to infiltrate. This joint survey only underscores this vast issue, highlighting that NHIs can not be treated the same as human identities.”

CSA and Astrix set out to dive deeper into how organizations perceive and handle NHI security, aiming to uncover the specific gaps and pain points in securing API keys, OAuth tokens, and more. The report reveals key findings:

• NHI attacks are surging and defenses are lagging: Nearly 1 in 5 organizations have experienced a security incident related to NHIs. The most common causes of NHI-related attacks were: lack of credential rotation (45%); inadequate monitoring and logging (37%); and over privileged accounts/identities (37%).
• Low confidence in securing NHIs compared to human identities: There is a significant gap in organizations' security methods with only 1.5 out of 10 organizations highly confident in their ability to secure NHIs, compared to nearly 1 in 4 for securing human identities. This lack of confidence in securing NHIs versus human identities could be due to the sheer volume of NHIs in their environment, which often outnumber human identities by a factor of 20 to 1.
• Fragmented approaches lead to security incidents: These tools are not specifically designed to address NHI security challenges; for instance: 58% use Identity and Access Management (IAM) systems; 54% use Privileged Access Management (PAM); 40% use API security measures; 38% employ Zero Trust/least privilege strategies; 36% use Secrets Management tools. As a result, the three most common causes of NHI security incidents include lack of credential rotation (45%), inadequate monitoring and logging (37%), and over-privileged accounts or identities (37%).
• Struggling with fundamental security practices related to NHIs: Major challenges that organizations encounter include auditing and monitoring (25%); access and privileges (25%); discovering NHIs (24%); and policy reinforcement (21%). Another significant concern is the struggle to gain visibility into third-party vendors connected by OAuth apps, with 38% of organizations reporting no or low visibility into third-party vendors, and another 47% having only partial visibility.

“As organizations increasingly acknowledge the critical need for robust NHI security, the surge in investments reflects a proactive stance toward protecting our digital infrastructures,” said Alon Jackson, CEO and co-founder at Astrix Security. “The key now is ensuring these investments are channeled into the right tools, especially as vulnerabilities persist. NHIs present unique challenges distinct from human identities, making their security complex and demanding. Addressing NHI security requires ongoing refinement, adaptable strategies, and a unified effort to tackle the ever-evolving threats head-on.”

For full access to the report, you can download it here: https://cloudsecurityalliance.org/artifacts/state-of-non-human-identity-security-survey-report.

Yeoh will be providing an in-depth analysis of the survey’s findings during the first-ever Non-Human Identity Security Conference on September 18 at the World Trade Center in New York. To register for this dynamic half-day conference focused on the cutting edge trends and tactics in NHI security, visit https://www.nhi-security.com/.

About Cloud Security Alliance
The Cloud Security Alliance (CSA) is the world’s leading organization dedicated to defining and raising awareness of best practices to help ensure a secure cloud computing environment. CSA harnesses the subject matter expertise of industry practitioners, associations, governments, and its corporate and individual members to offer cloud security-specific research, education, training, certification, events, and products. CSA's activities, knowledge, and extensive network benefit the entire community impacted by cloud — from providers and customers to governments, entrepreneurs, and the assurance industry — and provide a forum through which different parties can work together to create and maintain a trusted cloud ecosystem. For further information, visit us at www.cloudsecurityalliance.org, and follow us on Twitter @cloudsa.

About Astrix Security
Founded in Tel Aviv in 2021, Astrix Security helps enterprises close their biggest identity blind spot - Non-human Identities (NHIs). Astrix provides holistic visibility into all NHIs, automatically detecting and remediating over-privileged, unnecessary, misbehaving and malicious access tokens to prevent supply chain attacks, data leaks and compliance violations. Led by two veterans of the Israel Defense Force 8200 military intelligence unit, CEO Alon Jackson and CTO Idan Gour, Astrix's team is rapidly expanding. Astrix has raised nearly $40M in funding, with a Series A led by CRV, and additional investments from Bessemer Venture Partners, F2 Venture Capital, Venrock and Kmehin Ventures.

Media Contacts
Kristina Rundquist
ZAG Communications for the CSA
[email protected]

Liza Vilnits
Beyond Trending PR for Astrix Security
[email protected]