What is Service Account?
Service Account is a non-human identity used by an application, script, or automated process to authenticate and interact with other systems. Service accounts are often granted broad permissions, rarely rotated, and frequently lack a clear owner, making them a common target in attacks.
What it is
A service account is an identity created for a machine or process rather than a person. Applications use service accounts to connect to databases, call APIs, run scheduled jobs, and communicate with other services. They authenticate with passwords, API keys, certificates, or tokens stored in configuration files or environment variables.
Service accounts exist in nearly every environment: Active Directory service accounts, Kubernetes service accounts, cloud IAM service accounts, and database login accounts are all common examples.
Why it matters
Service accounts accumulate risk in predictable ways:
- Over-privilege. Developers often grant broad permissions to avoid troubleshooting access errors. Those permissions are rarely reviewed or reduced.
- No owner. The person who created the account may have left the organization. No one knows what the account does or whether it is still needed.
- Static credentials. Passwords and keys are set once and left unchanged for months or years.
- Poor visibility. Security teams frequently do not know how many service accounts exist or where their credentials are stored.
When an attacker compromises a service account credential, they inherit whatever access that account holds. Because service accounts often have elevated privileges and are not monitored like user accounts, attackers can move laterally for a long time before detection.
How tools address it
Non-Human Identity (NHI) tools and related categories tackle service account risk in several ways:
- Discovery. Scanning directories, cloud environments, and code repositories to find all service accounts, including forgotten ones.