Service Account
A non-human account used by an application or service to authenticate. Often over-permissioned and rarely rotated, making service accounts a frequent breach vector.
Service accounts are the most reliable finding in any identity audit: over-permissioned because scoping was hard on day one, never rotated because nobody knows what depends on them, and excluded from MFA policy because they cannot do MFA. Ownership is the fix that unlocks the others. An account with a named owner can be reviewed, scoped, rotated, and eventually replaced by a workload identity.
See also: non-human identity, client credentials, workload identity, what is non-human identity
Related on Start with Identity
- GlossaryAPI Key
A static secret string used to authenticate an application or caller to an API. Simple but weak: it does not expire on its own, is easy to leak, and should be v
- GlossaryAgentic Identity
Identity for autonomous AI agents that act on a user's behalf, call APIs, and chain tools. Requires scoped, delegated, auditable, and revocable credentials rath
- GlossaryBreak-Glass Account
A tightly controlled emergency account used only when normal access fails, with strong vaulting, monitoring, and alerting. Tested regularly so it works in a rea
- BlogAbbott investigates two incidents, one starting with a vished Entra account
Abbott confirmed unauthorized access to legacy Exact Sciences systems after a mid-June vishing attack compromised a Microsoft Entra single sign-on account. Shin
- CVEKeycloak First Broker Login TOCTOU, account-merge takeover
Keycloak's First Broker Login had a time-of-check/time-of-use gap. A phishing or race could merge an attacker's IdP account onto a victim. CVSS 3.1 on paper. Th
- BlogKeycloak password reset flaw let anyone skip the email token and take over any account
CVE-2026-18963 is improper state validation in Keycloak's reset-credentials flow. A crafted request jumped the authentication session straight to the password-u