# Do service accounts and API tokens need monitoring too?

Yes, and they are often the least watched accounts in the company. Service accounts run backups, scans, integrations and scheduled jobs, often with broad rights, passwords that never change and no multi-factor authentication. API tokens and keys for cloud services sit in scripts, configuration files and code repositories, where an attacker who finds one can use it from anywhere. Keep an inventory with an owner for each, give them only the rights they need, store secrets in a vault rather than in files, rotate them on a schedule and immediately when someone with access leaves, restrict where they may be used from, and alert when one is used from an unusual place or at an unusual time; your identity and cloud logs show that. On the network, a service account is always used from some host: NetSenX flags that host when it starts new sessions to other hosts, scans or uploads unusually much, on every plan. It does not see the token itself inside encrypted traffic.

FAQ: [Zero trust, identity and segmentation](https://netsenx.com/en/faq/zero-trust) · https://netsenx.com/en/faq/do-service-accounts-and-api-tokens-need-monitoring

## Read next

- https://netsenx.com/en/detect-lateral-movement-c2-beaconing
- https://netsenx.com/en/what-is-ndr

## Related questions

- [Are shared admin accounts a problem, and what should we do instead?](https://netsenx.com/en/faq/how-to-handle-shared-admin-accounts)
- [Are password managers safe for a company to use?](https://netsenx.com/en/faq/are-password-managers-safe-for-a-company)
- [What makes a good company password policy?](https://netsenx.com/en/faq/what-makes-a-good-company-password-policy)
- [What is single sign-on, and does it improve security?](https://netsenx.com/en/faq/what-is-single-sign-on-and-does-it-improve-security)
- [How do we monitor an external accountant's remote access to our PCs?](https://netsenx.com/en/faq/how-to-monitor-an-external-accountants-remote-access)