Every incident starts with a machine credential. Every detail is anonymized from real POC patterns.
Orphaned Credentials
01
The contractor left 18 months ago. The API key clocked in last night.
A 450-employee financial services company ran a nightly CRM sync built by a contractor in 2023. The integration authenticated every night with a full-scope API key that could read the entire customer base. The contractor left 18 months ago; the key had no owner, no rotation policy, and no expiry — and nobody knew it existed. It was one of 31 service accounts the first scan surfaced that no one on the team could explain.
Caught by
NHI InventoryISPM
Key inventoried and an owner named. The smaller scope is written up for the team that can re-issue it.
A free scheduling app had write access to the entire workspace. Nobody remembered saying yes.
At a 60-person B2B software company, an employee connected a free scheduling tool to Google Workspace in 2024 — one click on a consent screen. The grant included write access to calendars, files, and directory data, and it never expired. Within 48 hours of connecting, Cydenti mapped every OAuth app in the workspace; 12 held write scopes leadership had never knowingly approved.
Caught by
NHI InventoryNHI Graph
Excessive grants listed with an owner. Revocation stays with the team that approved them.
The support copilot read 4,200 CRM records in 3 minutes — 40× its baseline.
A 200-employee e-commerce mid-market firm deployed an AI copilot to summarize support tickets. It authenticated with a token, held standing HubSpot permissions, and answered to no manager. One afternoon its read pattern exploded to 40× its behavioral baseline — the signature of a hijacked token or a runaway agent, moving at machine speed. No MFA prompt would ever fire, because agents don't do MFA.
Caught by
ITDR
Owner named, and the spike shown against the agent's usual pattern. Stopping the session stays with the team that issued the token.
Dormant for 14 months. Then it authenticated — from an ASN nobody recognized.
A 300-employee industrial group had a legacy Salesforce sync account left over from a 2024 migration. It hadn't authenticated in 14 months — until one night it logged in from a hosting provider's network in another country. A dormant credential reactivating from a new ASN is a top post-breach pattern: attackers harvest stale machine credentials precisely because nobody watches them.
Caught by
ITDRISPM
Sign-in flagged and the timeline exported. Revoking the token stays with the team that owns the account.
"Send me your service-account inventory." The room went quiet.
A 350-employee logistics company entered NIS2 scope in 2026. Their auditor's first identity request wasn't about employees — ReCyF Objective 13 explicitly covers service accounts, machine credentials, and privileged access. They could export their HR directory in one click; their tokens lived in wikis, code, and the memories of departed admins. The audit clock did not care.
Caught by
NHI InventoryCompliance Reporting
Complete machine-credential inventory; audit evidence generated on demand.
Their vendor was breached last quarter. The OAuth token still worked.
A marketing team at a 150-employee services firm had connected an automation tool to Google Workspace with a full-scope grant — approved in one click, never reviewed. The vendor was publicly breached last quarter; the token it held could still read every document, calendar, and mailbox. Third-party breach does not equal third-party revocation: the credential outlives the trust.
Caught by
ISPMNHI Graph
Grant flagged with its scopes and blast radius. Narrowing it stays with the team that approved the app.
31 unexplained service accounts, found within a week
“Cydenti's first scan found 31 service accounts nobody could explain — including API keys created by contractors who left over a year ago, still authenticating every night.”
Director of IT (CIO/DSI)
Financial services ETI — 450 employees
Result
12 over-privileged OAuth apps, mapped in 48 hours
“Within 48 hours we had a complete map of every OAuth app connected to our workspace. Twelve had write access we'd never knowingly approved.”
CEO
B2B SaaS SMB — 60 employees
Result
Operational within a week, first report within a week
“We had no CISO and no budget for a full identity platform. Cydenti was operational within a week and gave us our first risk report within a week.”
IT Director
Industrial SMB — 120 employees
Testimonials anonymized at clients’ request. First inventory: usually within a week.
Common questions
What is a non-human identity?
Any credential that lets software act without a person logging in: service accounts, API keys, OAuth tokens, machine certificates, automation bots, and AI agents.
Are these real customer stories?
They are anonymized composites based on patterns we see in real POCs and deployments. Names, vendors, and exact sizes are changed; the risk patterns are not.
How fast can Cydenti find these risks?
Most environments are connected within a week via read-only API. The first risk report is typically delivered within a week.
Ready to secure your future?
Discover the machine identities you didn't know you had — the first inventory usually lands within a week.
The Audit Flash connects up to three SaaS apps through a read-only API and lists the service accounts, orphaned credentials, OAuth grants, and AI agents it can see. The first identity inventory usually lands within a week. A full sharing scan on a large tenant can take longer. No commitment.
