Every incident starts with a machine credential. Every detail is anonymized from real POC patterns.
Orphaned Credentials
01
The contractor left 18 months ago. The API key clocked in last night.
A 450-employee financial services company ran a nightly CRM sync built by a contractor in 2023. The integration authenticated every night with a full-scope API key that could read the entire customer base. The contractor left 18 months ago; the key had no owner, no rotation policy, and no expiry — and nobody knew it existed. It was one of 31 service accounts the first scan surfaced that no one on the team could explain.
Caught by
NHI InventoryISPM
Key inventoried, owner assigned, re-issued with minimal read scope.
A free scheduling app had write access to the entire workspace. Nobody remembered saying yes.
At a 60-person B2B software company, an employee connected a free scheduling tool to Google Workspace in 2024 — one click on a consent screen. The grant included write access to calendars, files, and directory data, and it never expired. Within 48 hours of connecting, Cydenti mapped every OAuth app in the workspace; 12 held write scopes leadership had never knowingly approved.
Caught by
NHI InventoryNHI Graph
Risky grants revoked or down-scoped in a guided review.
The support copilot read 4,200 CRM records in 3 minutes — 40× its baseline.
A 200-employee e-commerce mid-market firm deployed an AI copilot to summarize support tickets. It authenticated with a token, held standing HubSpot permissions, and answered to no manager. One afternoon its read pattern exploded to 40× its behavioral baseline — the signature of a hijacked token or a runaway agent, moving at machine speed. No MFA prompt would ever fire, because agents don't do MFA.
Dormant for 14 months. Then it authenticated — from an ASN nobody recognized.
A 300-employee industrial group had a legacy Salesforce sync account left over from a 2024 migration. It hadn't authenticated in 14 months — until one night it logged in from a hosting provider's network in another country. A dormant credential reactivating from a new ASN is a top post-breach pattern: attackers harvest stale machine credentials precisely because nobody watches them.
"Send me your service-account inventory." The room went quiet.
A 350-employee logistics company entered NIS2 scope in 2026. Their auditor's first identity request wasn't about employees — ReCyF Objective 13 explicitly covers service accounts, machine credentials, and privileged access. They could export their HR directory in one click; their tokens lived in wikis, code, and the memories of departed admins. The audit clock did not care.
Caught by
NHI InventoryCompliance Reporting
Complete machine-credential inventory; audit evidence generated on demand.
Their vendor was breached last quarter. The OAuth token still worked.
A marketing team at a 150-employee services firm had connected an automation tool to Google Workspace with a full-scope grant — approved in one click, never reviewed. The vendor was publicly breached last quarter; the token it held could still read every document, calendar, and mailbox. Third-party breach does not equal third-party revocation: the credential outlives the trust.
Caught by
ISPMNHI Graph
Flagged in 27 minutes; revoked and re-issued with minimal scope. Risk score 98 → 11.
31 unexplained service accounts, found in 27 minutes
“Cydenti's first scan found 31 service accounts nobody could explain — including API keys created by contractors who left over a year ago, still authenticating every night.”
Director of IT (CIO/DSI)
Financial services ETI — 450 employees
Result
12 over-privileged OAuth apps, mapped in 48 hours
“Within 48 hours we had a complete map of every OAuth app connected to our workspace. Twelve had write access we'd never knowingly approved.”
CEO
B2B SaaS SMB — 60 employees
Result
Operational in 27 minutes, first report in 3 hours
“We had no CISO and no budget for a full identity platform. Cydenti was operational in under 27 minutes and gave us our first risk report in less than 3 hours.”
IT Director
Industrial SMB — 120 employees
Testimonials anonymized at clients’ request. Average deployment: 27 minutes.
Common questions
What is a non-human identity?
Any credential that lets software act without a person logging in: service accounts, API keys, OAuth tokens, machine certificates, automation bots, and AI agents.
Are these real customer stories?
They are anonymized composites based on patterns we see in real POCs and deployments. Names, vendors, and exact sizes are changed; the risk patterns are not.
How fast can Cydenti find these risks?
Most environments are connected in 27 minutes via read-only API. The first risk report is typically delivered within 3 hours.
Ready to secure your future?
Discover the machine identities you didn't know you had — in 27 minutes, for free.
NIS2 enforcement begins October 1, 2026. The Audit Flash delivers your complete NHI exposure snapshot — service accounts, orphaned credentials, OAuth grants, AI agents — with a first report in 3 hours. No commitment.
