Service account
Also called: bot account, system account
A non-human account meant for automation, often with broad standing privileges and weak lifecycle controls.
Service accounts run jobs, connect systems, and now back agents and MCP servers. They tend to accumulate permissions ("just give it admin so the integration works"), rarely rotate secrets, and often have no clear owner. When an agent uses a service account, it inherits all of that.
Why it matters
A service account is a pre-built privilege escalation path for anyone who can drive the agent. The fix is unglamorous: give each agent or integration its own account, scope it to exactly what it needs, use short-lived credentials, and log its actions separately so you can tell the agent's activity from a human's.
Exposure map
Live counts of instances showing this pattern will appear here once the exposure map is collecting data.