SSH keys are everywhere. They’re in CI/CD pipelines, server configs, developer laptops, and cloud instances. And almost nobody manages them properly.
That’s the core argument of a recent SC Media webcast on machine identities — a topic that deserves more attention than it gets. Machine identities outnumber human identities by roughly 100 to 1 in most organizations. Every server, container, and automated process relies on some form of credential to talk to other systems. SSH keys are a huge part of that.
The problem is sprawl. Keys get generated and never rotated. They’re stored in home directories, config files, and scripts. Nobody tracks where they all live. Attackers love this — unmanaged SSH keys are a goldmine for lateral movement. Get one key and you can hop across systems without triggering alarms.
Info stealers make this worse. A compromised developer workstation can leak hundreds of keys. Traditional security tools don’t flag SSH key misuse because the traffic looks legitimate — it’s encrypted, it’s using port 22, it’s exactly what normal operations do.
The webcast covered the path to zero trust for machines: discovery first, then inventory, then moving toward ephemeral, just-in-time access with certificates replacing static keys where possible. Compliance frameworks like PCI, SOC 2, and HIPAA are starting to push organizations in this direction.
The bottom line? If you can’t see your machine identities, attackers can.
