Ephemeral accounts grant random high privileges but hinder audits, forcing SOC teams into blind incident response.