Imagine uninvited digital strangers residing in your digital basement with access to the most obscure corners of your network. They are logged into your private file systems and actively browsing your most sensitive online accounts, yet you have no idea they are there.
This isn’t a glitch; it’s the silent reality of unmonitored service accounts and rogue bots. They operate with persistent access to your data, remaining active in the background, out of sight, and entirely off your radar.
A one-on-one conversation between Greg and Mark from Clarity Security, discussing Protecting Your Online Identity at the 2026 Secure World Conference in Boston, MA
Most people lock their front door but forget about the hidden side entrance. Here’s what that means for your online accounts — and why it matters more than you think.
Think of your online accounts like a house. You probably lock the front door (your password) and maybe even add a deadbolt (two-factor authentication). But what if someone was already living in your basement — and you had no idea?
Your Identity Online: It’s More Than Just You
When most people think about their “online identity,” they picture their email login or their username on a social media app. And yes, that counts. But according to Mark from Clarity Security, who sat down with Greg Philips at the SecureWorld conference in Boston, the story goes much deeper than that.
“Identity is the new perimeter,” Mark explained. In old-school cybersecurity, companies focused on protecting their physical building or their network. Today, the real battleground is your identity — the digital keys that prove who you are and what you’re allowed to access.
Key stat: For every one human online identity, there are roughly 140 non-human identities — bots, apps, and automated accounts operating in the background.
Wait — What’s a “Non-Human Identity”?
You might be thinking, “I’m a person. Why would I have 140 extra identities?” Good question. These extra identities aren’t yours personally — they belong to the apps and services running inside your company’s systems. Here are some common examples:
Resource Accounts
Shared logins used for things like a company printer, a conference room calendar, or a shared inbox. No single person “owns” these.
Service Accounts
Background accounts that let software programs talk to each other automatically — like your invoicing app connecting to your accounting software.
AI Bots & Agents
Newer tools like AI assistants or automation bots that have their own logins and permissions to do tasks on your behalf.
“A five-person company could easily have 50 or even 100 of these non-human accounts floating around — and most business owners don’t even know they exist.”
— Greg Philips, MyTechCoach
The “Skeleton Key” Problem
Here’s where it gets scary. Many of these non-human accounts are set up quickly, then forgotten. Over time, they quietly collect more and more permissions — access to files, emails, customer data, financial records — way more than they actually need. Security pros call this being overprivileged.
Mark used a vivid analogy: imagine a stranger living in your basement with a skeleton key to every room in your house. They can wander in, help themselves to whatever’s lying around, and you’d never even know. That’s exactly what an unmonitored service account or rogue bot can do inside your business systems. It has access. It’s active. And nobody is watching it.
So What Can You Actually Do About It?
Tools like Clarity Security are built specifically to tackle this problem. Their approach starts with visibility — basically, shining a flashlight into that digital basement so you can see exactly who (or what) is in there. For IT professionals like Greg who work with small and medium businesses, having a tool that can map out every identity, human and non-human, inside an Office 365 or Google Workspace environment is a game-changer. It answers questions like:
- What accounts exist, and who owns them?
- What do those accounts have access to?
- Are any of them accessing things they really shouldn’t?
Once you have that visibility, you can set guardrails — rules that limit what each account can do — and set up monitoring so you get an alert if something suspicious happens.
3 Things You Should Do Right Now
- Use strong, unique passwords for every account. A password manager makes this easy.
- Turn on multi-factor authentication (MFA) everywhere you can — especially email, banking, and cloud services.
- Ask your IT person to audit your non-human accounts. Find out what service accounts exist in your Office 365 or Google Workspace, what they have access to, and whether anyone is monitoring them.
The Bottom Line
Cybersecurity isn’t just about protecting your own login anymore. Every business — even a tiny five-person shop — has a web of digital accounts running behind the scenes. Ignoring them is like handing out skeleton keys to your house and hoping nobody walks through.
The good news? With the right tools and a little awareness, you can take back control. Start by knowing what’s in your basement.
Greg has been put through the test from eccentric people in the sticks of Vermont; to small business owners with funky old PCs; to large college campuses such as Dartmouth where he worked in IT for over five years.
Greg has a Masters Degree in IT Business Management, as well as being Apple and Microsoft MCP certified.
