One question separates a controlled identity estate from an exposed one: who can name the human responsible for the service account running tonight’s finance batch? The answer often stalls. The engineer who provisioned it moved on years ago, yet the credential still lives in a vault or a stray config file, holding permissions from a migration that closed before the present team was hired.
Two surveys make the gap concrete. A count of 109 machine identities for every human identity is the average Palo Alto Networks reached after polling more than 2,900 security leaders for its 2026 Identity Security Landscape. Entro Labs measured lifespan instead: nearly half had passed the one-year mark, and 7.5% were somewhere between five and ten years old.
For a decade the standard answer has been a vault plus a rotation schedule, which beats a hardcoded string — no one should tear out a vault that works. What rotation never does is narrow access. Only the secret changes. Every permission stays intact, readable wherever the application fetches it, so a copy taken on day three of a ninety-day cycle keeps working for close to three months.
Refresh tokens compound the problem, renewing themselves long after the approving grant has slipped from memory. Salesloft’s Drift integration gives the clearest recent demonstration. Between August 8 and 18, 2025, an actor Google Threat Intelligence Group tracks as UNC6395 reached Salesforce customer instances through stolen OAuth and refresh tokens and pulled data out, an intrusion that swept up more than 700 organizations. Nothing tripped: the tokens were real and no human was signing in.
Zero standing privilege is the alternative: nothing usable sits idle, and access arrives on demand, scoped to a job and expiring with it. Begin with the widest-reaching accounts and attach a named person to each.
