Industry trends and reports
Every secret scanner hands you a big number, and almost nobody can act on it. When we verified each finding against the service that issued it, a five-figure detection count became a three-figure inventory of credentials that actually work. This is what that collapse means for how you prioritize, what you suppress, and what you tell your board.
We spent six months documenting why non-human identity (NHI) security fails in real organizations, from bug bounties that call leaked keys "out of scope" to the nine-part NHI Kill Chain. Argus is the product we built from what that research proved.
Every agent action is a credential action, and the industry is treating a governance shift as a provisioning task, exactly the way it did with service accounts.
The Korean GitHub token leaks and CISA's public-repo exposure were both filed as secrets leaks. What got out was not a file but a live identity. This piece argues that security leaders should treat API keys as identities and shift the defense from prevention rate to how fast you detect what has already leaked.
A leaked Slack incoming webhook is usually triaged as low severity: write-only, one channel, no data access. The moment an AI agent reads that channel and can act with tools, that write-only primitive becomes an indirect prompt injection path into the agent's privileges. Here is the full kill chain, the exact preconditions, and how to defend it.
A single AWS key, never rotated for 3 years, spread across 7 systems. When a supply chain attack hit a Terraform CI plugin, the key gave attackers full infrastructure access. Inside the Aged Key kill chain and how to defend against long-lived credentials.
A .env file pushed to a public GitHub repo is found by attacker bots in 4 minutes. We map the full kill chain, from credential exposure to infrastructure compromise, and show how to detect and respond before the damage is done.
The Cremit team's report on identity and detection trends for 2025, available to download in full.
Model Context Protocol (MCP) and Agent-to-Agent (A2A) communication are redrawing the NHI security boundary. What changes when AI agents become first-class identities in your infrastructure.
We use cookies to measure traffic and ad performance. Declining costs you nothing: the site keeps working, and all that stays is your language and this answer. Everything we load is listed in the cookie policy