Non-human identities are 91% of everything active in production
A backup job fires at two in the morning. A scanner walks the same AWS account an hour later, a deployment pipeline assumes a role at four, and a logging agent runs straight through the night. Each of those actions carries a credential issued to a machine.
An attacker holding one of those credentials inherits the same cover. Only 20% of non-human activity in production falls inside standard business hours, which puts a rogue API call at 3 a.m. in the middle of normal traffic. Time of day tells a defender almost nothing.
Attackers have already built on this. In June 2026, stolen credentials and trusted publishing workflows pushed malicious packages through Red Hat’s legitimate channels in the compromise known as Miasma. Two months earlier, a compromise of the LiteLLM project fed the Mercor breach. In May, researchers watched an LLM-driven workflow use harvested cloud credentials to pull secrets out of AWS Secrets Manager.
Machines own the account
Nine in ten active identities in production belong to something other than a person. ClearVector puts the figure at 91% in its 2026 Identity Intelligence Report, drawn from the AWS and Google Cloud environments it monitors, counting service accounts, execution roles, managed identities, and vendor credentials.
The identity provider confirms who authenticated. The cloud posture tool confirms the configuration. “None of these tools can determine whether a specific identity’s behavior is legitimate,” ClearVector researchers explain.
The destructive calls come from machines
Human sessions in production are mostly reading. 99% of observed human activity consisted of Describe, List, Get, and similar calls, which fits a population of engineers debugging and checking dashboards.
Machine identities carry a different profile. Delete and terminate calls account for 3% of non-human activity, with privileged create-and-modify operations adding a few points on top. A compromised service account executes at machine speed and volume, which is what makes a small percentage worth alerting on.
Vendors get everything
Third-party credentials are 4% of the identity population. The top four vendor identities each reached across the entire production environment, spanning multiple regions and services.
One of them, a security vendor, spent 40% of its observed calls on destructive actions. Read-only traffic made up the rest.
Weekends are the one place a simple rule still works
Weekend traffic stays under 5% of total activity across every identity type. A Saturday surge stands out without any modeling behind it.
A backup job that runs at 2 a.m. every night is easy to model. Catching the night it runs twice depends on someone having kept the first one on file.
Download: The ultimate guide to network operations management