Sentyn is an ownership-first machine identity security console. It discovers IAM roles, service accounts, tokens, and automation identities read-only, assigns owners with evidence, maps blast radius, and exports audit-ready proof without storing raw secrets.

What problem does Sentyn solve?

Organizations inherit thousands of machine identities with unclear owners, excessive privilege, and no evidence trail for auditors. Sentyn names identities, surfaces unknown owners as findings, and packages proof in the same workflow security teams use to triage risk.

How is Sentyn different from a secrets manager?

Secrets managers store and rotate credentials. Sentyn inventories and governs machine identities across cloud and CI/CD, stores only redacted evidence, and never replaces HashiCorp Vault, AWS Secrets Manager, or CyberArk vault functions.

Which connectors are production-ready?

None are currently claimed as production-ready or live-proven. The executable catalog contains 31 configurable beta providers and 3 demo fixtures. Beta means the setup and pipeline exist; production proof requires a successful real-source sync and provider-specific validation.

Does Sentyn write to cloud providers?

Discovery is read-only by design. Remediation workflows can generate, approve, reject, retest, and roll back plans, but provider writes remain gated behind explicit flags and entitlements rather than running automatically by default.

What evidence does Sentyn export for audits?

Inventory snapshots, ownership status, finding evidence panels, relationship graph metadata, and append-only audit events. Exports are tenant-scoped and redacted.

What is machine identity security?

Machine identity security governs non-human credentials and automation principals: IAM roles, service accounts, API keys, OAuth apps, CI tokens, and workload identities. It covers inventory, ownership, least privilege, blast radius, and lifecycle accountability.

Cloud security, identity engineering, platform security, and GRC teams that need to understand machine identities, accountable owners, access paths, risk, and the evidence behind each decision.

← Knowledge center

Incidents

Public incidents involving machine identities

Documented breaches tied to service accounts, CI secrets, tokens, and automation credentials from official postmortems.

Research narrative by Het Mehta, Research and product narrative. Sources are public competitor reports, vendor documentation, and official incident disclosures.

2023 · Okta

Support system service account compromise

Attackers used a compromised service account tied to Okta customer support. Stolen session artifacts in support files enabled downstream customer session hijacking attempts.

Service accounts with broad support access require the same ownership, rotation, and evidence discipline as production IAM roles.

Okta Security blog, November 2023

2023 · CircleCI

Engineer session led to customer secret exfiltration

A compromised engineer laptop session allowed access to databases holding customer environment variables, tokens, and API keys used in CI.

CI/CD platforms concentrate machine credentials. Inventory and blast radius mapping must include pipeline secrets, not only Git commits.

CircleCI official incident report, January 2023

2022 · Slack

Employee token misuse against GitHub

Stolen employee tokens were used to access external GitHub repositories and download private code.

Developer tokens bridge human and machine identity boundaries. Owner attribution and scope review must cover employee-issued automation credentials.

Slack security blog, January 2023

2023 · Microsoft

Over-permissive Azure SAS token exposure

A researcher-shared URL contained an overly broad shared access signature, exposing internal backup and collaboration data.

Cloud storage tokens are machine identities with implicit blast radius. Least privilege and expiry enforcement need continuous inventory.

Microsoft MSRC blog, September 2023

2021 · Codecov

Supply chain script modification

Attackers altered a Bash uploader script for months, exporting CI environment variables that often contained customer API keys and tokens.

Third-party CI tools inherit secrets from every customer pipeline. Supply chain identity risk extends beyond your own repositories.

Codecov security update, April 2021

2023 · Cloudflare

Okta support breach session reuse

Session material from Okta support system exposure was used in an attempt to access Cloudflare administrative accounts.

Downstream identity providers amplify single machine identity failures across the vendor graph.

Cloudflare engineering blog, October 2023

2022 · Uber

Contractor compromise to internal tools

After MFA fatigue on a contractor account, attackers accessed internal SSO and cloud tooling, forcing broad key rotation across services.

Contractor and workforce-adjacent identities often hold paths to service accounts and automation keys with unclear owners.

Uber newsroom security update, September 2022

2022 · LastPass

DevOps secrets in cloud backups

Follow-on access to cloud storage backups exposed DevOps secrets, integration keys, and customer vault material.

Secrets managers do not replace governance. Backup paths and break-glass credentials are machine identities requiring owners and evidence.

LastPass security blog, March 2023

Run the checklist on your footprint

Read-only connect, owner queue, one finding with evidence, audit export sample.

Book a product demo