A Valid Login Can Still Be Criminal Activity
Stolen tokens, service identities, subscriptions, and servers let attackers operate through credentials that monitoring systems may initially treat as legitimate. The control problem is therefore behavioral: distinguish approved work from a new actor using the same technical identity.
A useful definition names the operating object, its owner, the permitted result, and the condition that makes the result unacceptable. Capability alone is not evidence that the surrounding business process can control the work.
Write the boundary in language that operations, security, finance, and the accountable business owner can all test. If those groups interpret the boundary differently, the system is not ready to scale.
AI Identities Accumulate Quiet Authority
AI workloads often combine long-lived credentials, broad APIs, external destinations, background schedules, and elastic compute. When ownership, purpose, and normal behavior are not recorded together, an attacker can consume resources or analyze stolen information without crossing a simple login rule.
Most failures are produced by ordinary seams: identities outlive assignments, queues hide unfinished work, integrations change, controls are configured but not exercised, and physical conditions drift from the demonstration. The visible AI output is often the last link in a longer chain.
Map the complete path from request through action, evidence, exception, and closure. The map should show where state is stored, who may change it, and what happens when a dependency is unavailable.
Abuse Creates Cost Before A Breach Is Confirmed
Direct exposure includes model charges, cloud compute, fraud investigation, credential rotation, customer response, and interrupted workflows. A practical routine-cost estimate is anomalous events × review minutes ÷ 60 × loaded hourly rate, while fraud and disclosure scenarios remain separate.
Keep routine operating cost separate from low-frequency, high-consequence exposure. A blended number can make a serious control gap look inexpensive or make a manageable exception process look catastrophic.
For recurring work, use volume × exception rate × handling minutes ÷ 60 × loaded hourly rate. Record security, legal, safety, customer, and availability scenarios separately with named assumptions rather than inventing one false expected-loss figure.
Build The Baseline From Approved Work
Record normal calling identities, models, tools, destinations, data classes, volumes, token rates, schedules, geographies, spend, and error patterns for each service account. Then test impossible travel, new device-code grants, unusual mailbox access, outbound scanning, rapid cost growth, and dormant credentials returning to life.
Score each diagnostic item as documented and tested, documented but untested, informal, or absent. Vendor documentation is useful context, but deployed configuration and a dated result are the evidence that matters.
Replay a normal case, a blocked case, an ambiguous case, and a dependency failure. Follow each one through detection, ownership, containment, correction, and evidence retention.
Choose Prevention, Detection, And Containment Together
Phishing-resistant authentication, workload identities, short-lived tokens, least privilege, destination controls, budget limits, and behavioral alerts solve different parts of the problem. No product label substitutes for a tested containment path that can revoke access without destroying evidence.
The realistic choices usually include retaining the current manual control, configuring an existing platform, adding a narrow compensating control, automating only reversible steps, or building a focused system. Doing nothing can be rational when consequence is low and control cost is disproportionate.
Choose according to consequence, reversibility, transaction volume, integration depth, and evidence needs. Partial automation often captures most of the value while keeping a person at the irreversible decision.
Issue Every AI Identity An Operating Profile
The profile should bind the identity to a business owner, approved workload, data, tools, destinations, schedule, expected volume, cost range, alert thresholds, credential lifecycle, and emergency action. Monitoring can then compare observed behavior with a versioned purpose rather than a generic peer group.
Begin with the smallest enforceable record: purpose, scope, identities, data, permitted actions, prohibited outcomes, approvals, telemetry, exception owner, stop action, and review date. Connect every statement to a configuration, test, or operating artifact.
Release in stages—observe, recommend, execute reversible work, then expand only when measurements support it. Authority and exceptions should expire unless an accountable owner renews them with current evidence.
A Small Variance Shows The Review Load
Suppose 60 AI identities generate 120,000 daily actions and 0.08 percent are outside baseline: 96 events. At eight review minutes and a $72 loaded hourly rate, routine triage is 96 × 8 ÷ 60 × $72, or $922 per day before tuning.
The example is illustrative, not a reported client result. It makes assumptions visible so another organization can replace them with its own volumes, rates, failure costs, service levels, and control performance.
Rerun the calculation after a material change to the model, identity system, tools, data, facility, vendor, workflow, or approval design. Evidence from an earlier version does not automatically validate the current one.
Measure Time To Recognize And Revoke
Track new credential grants, baseline violations, false-positive rate, time to owner confirmation, time to revoke, unowned identities, unused privileges, spend variance, preserved evidence, and recurrence after corrective action. Report sensitive workflows separately from low-risk experimentation.
Pair outcome measures with guardrails. Faster completion or higher automation is not success if exceptions age, unauthorized activity rises, evidence disappears, equipment damage increases, or people repeat the work to reach a trustworthy answer.
Review median and tail performance by workflow and risk tier. A blended average can hide the small group of cases that creates most of the cost or exposure.
Profile The Five Most Powerful Identities First
Choose the accounts with the broadest data, tool, payment, administrative, or external-system reach. For each, document normal behavior, trigger one safe anomaly, verify that the right person receives usable evidence, and confirm that revocation stops the workload cleanly.
Give the review a deadline and a decision: retain, narrow, expand, repair, or stop. An assessment without a decision owner becomes documentation theater and allows temporary exceptions to become permanent practice.
A one-page starting record is enough: workflow name, version, owner, intended outcome, prohibited outcome, evidence links, last test date, top unresolved exception, and next review date.
Sources, Method, And Limits
This article uses the current news event as an editorial trigger and combines it with primary or authoritative material. It provides an operating framework, not legal advice, a product endorsement, or a claim that one control can eliminate every failure.
The framework, formula, diagnostic, and worked example are SynHy analysis. Organizations should replace illustrative assumptions with their own evidence and involve security, legal, privacy, safety, labor, accessibility, facilities, and domain specialists when consequences can be material.
- Microsoft report on disrupting EvilTokens — describes AI-assisted account compromise, inbox analysis, impersonation, and fraud planning
- Microsoft Digital Crimes Unit EvilTokens pleadings — provides the public legal notice and case context for the disruption
- NIST Digital Identity Guidelines — provides current identity, authenticator, and federation guidance
Product capabilities and threat conditions change. Confirm the current vendor documentation, deployed configuration, contractual allocation, and applicable requirements before relying on any control described here.