Why machine identity breaches need their own incident playbooks
- Severity
- Low
- Sources
- 1
What happened
Incident playbooks built around human accounts stall when the compromised identity is a service account, API key or OAuth token, because there is often no clear owner and no safe way to contain it without breaking a service. The article cites Cloudflare's 2023 incident, where four unrotated service account credentials were missed and an alert fired more than a week after first access, and the August 2025 Drift incident, where stolen OAuth tokens were used against Salesforce for about ten days. It recommends documenting an owner and the impact of removal for each high-privilege non-human identity, tiering them by blast radius, and pre-authorising revocation.
For IT people · Written by AI from 1 source · Wrong?
What to do
- Build an inventory of high-privilege service accounts, API keys and OAuth apps, recording the owning team and what would fail if each were removed.
- Pre-authorise by name who can approve immediate revocation of high-tier machine identities, even if it disrupts a service.
- Remove or rotate credentials and OAuth apps that are no longer needed, including those issued for finished projects.
- Confirm cloud audit logging is turned on for machine identities so that sign-in location and permission changes can be checked.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Who and what is in it
Threat actors
Companies
Products