NHI Hound maps the trust paths dormant service accounts leave into your identity provider

Security researcher Aleksandr Krasnov built NHI Hound, an open source tool released around Black Hat USA 2026, to address what he calls ghost credentials: non-human identities that are still active in the cloud, still carry real permissions, and have no owner, purpose, or lifecycle attached to them. NHI Hound ingests identity data from providers including Okta, GitHub, and cloud IAM platforms, then maps the hidden trust links between human and non-human accounts and simulates worst-case abuse paths, so a defender can see which dormant credentials actually chain into production systems or identity-provider admin roles. Krasnov's methodology includes turning a single leaked key into a full cloud compromise by pivoting through chained trust relationships into the identity provider itself. Informal testing at small and midsize organizations found real remediation typically takes six to nine months once a team can see its actual NHI trust graph.

Why it matters

Ghost credentials are the machine-identity version of a problem non-human identity programs already know: an inventory tells you an account exists, not whether it's a dead end or a direct path to your identity provider's admin console. Most NHI sprawl efforts stop at counting, this tool's contribution is ranking by actual blast radius.

The six-to-nine-month remediation timeline is the number worth planning around rather than the tool itself: seeing the trust graph is the fast part, and the finding here is that cleaning it up, revoking access, assigning owners, retiring what's truly dead, is a sustained program, not a scan-and-done project.

Source: Dark Reading