TL;DR: AI is accelerating attack speed by 4x, identity weaknesses appeared in 89% of investigations, and 87% of attacks crossed multiple surfaces, according to Palo Alto Networks’ Unit 42 report based on its analysis of more than 750 incidents. The governance problem is no longer isolated controls but compound trust failure across human, machine, and agentic identities.
At a glance
What this is: This Unit 42 report argues that AI, identity weakness, and cross-surface complexity are now the main conditions driving modern breaches.
Why it matters: It matters because IAM, NHI, and PAM teams now have to treat identity trust, not just perimeter hardening, as the primary breach constraint.
Context
Modern breach patterns are no longer dominated by one control failure at a time. The problem space is the interaction between AI-accelerated attacker workflows, weak identity governance, and enterprise environments where access spans endpoints, cloud, SaaS, browsers, and identity systems at once.
For identity programmes, that means the boundary between human access, machine access, and agentic access is becoming operationally indistinct from an attacker's point of view. The governance gap is not just more accounts or more tools, but more opportunities for implicit trust to persist across those identities.
This post examines the implications of Palo Alto Networks’ Unit 42 report for IAM, NHI, and autonomous identity governance. The article's figures are a signal that identity controls are now part of breach velocity, not just breach scope.
Key questions
A: Identity controls lose effectiveness when the same credential, token, or session can be reused across cloud, SaaS, browser, and endpoint environments. The control failure is not only exposure but portability, because attackers can convert one successful login or token theft into movement across the wider environment before defenders intervene.
Q: Why do AI-driven attacks force changes in identity governance?
A: AI-driven attacks compress the time available to detect misuse and reduce access. That means identity governance must support faster signals, tighter privilege scope, and automated remediation. If approval cycles are slower than attacker movement, the governance model is already behind the threat.
Q: How can security teams know whether identity controls are actually reducing breach impact?
A: Look for evidence that suspicious accounts are contained fast, active sessions are terminated, and privileged access is limited to the smallest possible set of systems. If a compromised account can still reach sensitive resources after detection, the controls are not working well enough to limit impact.
A: They should treat delegated access, service credentials, and autonomous actions as one governance problem, not three separate ones. That means clarifying ownership, limiting reuse, and revoking stale access paths wherever identity can cross between people, workloads, and agents without a fresh trust decision.
Technical breakdown
Why AI compresses the breach timeline
The report says the fastest attacks now move from initial access to data exfiltration in 72 minutes, a 4x increase over the past year. That is not just faster operator behaviour. It means attacker decision-making, follow-on tooling, and sequencing are increasingly machine-assisted, so dwell-time assumptions built into traditional detection and response are collapsing. When adversaries can automate reconnaissance, credential abuse, and follow-on movement, control latency becomes a security variable in its own right. The practical effect is that containment has to happen closer to the first identity event, not at the end of a long alert chain.
Practical implication: shorten triage and containment paths around identity events rather than relying on slower post-compromise investigation.
How cross-surface attacks turn identity into the control plane
Unit 42 says 87% of attacks span two or more attack surfaces, with activity observed across endpoints, cloud, SaaS, and identity systems. That matters because identity is often the shared authorization layer across those surfaces. Once a credential, token, or browser session is accepted in one environment, attackers can pivot into others without needing a separate exploit each time. This is why the browser, SaaS applications, and cloud consoles increasingly act like one connected trust fabric from the attacker's perspective. Governance that treats each surface independently misses the way privilege is reused and propagated.
Practical implication: govern identity, session, and token trust across surfaces as one attack path rather than as separate domain controls.
Why credentials and OAuth tokens remain the most reusable breach assets
The report says 65% of initial access is driven by identity-based techniques, while third-party SaaS attacks have surged 3.8x since 2022 and now account for 23% of all attacks. That combination points to the same structural weakness: credentials, OAuth tokens, and API keys are durable enough to outlast the moment they were issued. They become reusable trust artifacts in environments where access is loosely tied to human action, SaaS integration, or browser session state. For defenders, the technical issue is not just theft. It is the long-lived portability of identity artefacts across systems and business relationships.
Practical implication: prioritize inventory, revocation, and scope reduction for credentials that can move between SaaS, cloud, and browser workflows.
Threat narrative
Attacker objective: The objective is to turn reusable identity trust into fast multi-surface access that enables data theft, lateral movement, and operational disruption before defenders can contain it.
- Entry often begins with identity-based techniques such as social engineering or credential misuse, which the report says drive 65% of initial access.
- Once access is obtained, attackers use credentials, OAuth tokens, or API keys to bridge from one surface to another across endpoints, cloud, SaaS, and identity systems.
- The result is rapid exfiltration or other impact, with the fastest observed attacks reaching data theft in 72 minutes.
Breaches seen in the wild
- Palo Alto Networks Salesforce data theft 2025: Stolen Drift OAuth tokens exposed Palo Alto Networks CRM data, including support notes where some customers had shared credentials.
- ArtiPACKED 2024: Unit 42 found public GitHub Actions artifacts in major open source projects leaking live GITHUB_TOKENs, runtime tokens and cloud tokens.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Identity weakness is no longer a control gap, it is a breach accelerant. When 89% of investigations involve identity weakness, the issue is not limited to bad passwords or weak MFA placement. It shows that identity has become the recurring failure surface that lets AI-driven attacks move faster than human governance cycles. The implication for practitioners is that identity trust must be managed as an attack-surface problem, not only as an access-admin problem.
Implicit trust is the named concept now shaping breach complexity. The report's picture is not of isolated compromise but of attackers exploiting the assumptions that access remains trustworthy across sessions, surfaces, and systems. That assumption was tolerable when workflows were slower and more segmented. It breaks when identity artefacts can be reused across browsers, SaaS, cloud, and machine-driven workflows in one campaign. Practitioners should read this as a collapse of trust boundaries, not just a rise in incident volume.
Human, machine, and agentic identities are converging in the attack path. Unit 42 explicitly points to autonomous AI agents bridging human and machine identities for independent action. That matters because the same governance model is being asked to cover user behaviour, service credentials, and agentic delegation at once. The result is a compound trust problem where the attacker does not need to care which identity type was first compromised. Practitioners need governance that understands delegation chains across all three identity classes.
Attack speed is now an identity governance issue, not only a detection issue. A 4x increase in attack speed changes the value of every control that depends on review, escalation, or delayed remediation. If access can be abused and moved before an analyst or approver acts, then governance based on periodic checks is already behind the threat. The field should treat identity containment as a speed problem as much as a scope problem.
Enterprise complexity is functioning as attack leverage. The report shows attacks spanning as many as 10 different fronts simultaneously, which tells us complexity is not merely operational friction. It is an enabler that lets adversaries blend legitimate sessions, third-party access, and multi-surface movement into one campaign. For practitioners, the lesson is that control sprawl without trust simplification creates more places for abuse to hide.
What this signals
Identity programmes now need to assume that the first successful credential or session event can become the whole breach path. That changes the priority order for most teams, because trust reduction and containment speed matter more than adding another layer of post-event visibility.
Cross-surface trust sprawl: when access can move from browser to SaaS to cloud with little friction, the security model is already too permissive for today's attack tempo. Practitioners should look for where identity scope is broader than the business process that issued it.
For practitioners
- Reduce implicit trust across identity and session paths Map where a single credential, token, or browser session can unlock multiple environments, then remove unnecessary reuse paths between SaaS, cloud, and endpoint access.
- Prioritise identity event containment over broad alert volume Tune response playbooks so that suspicious authentication, token use, and delegated access events trigger immediate containment decisions rather than extended investigation queues.
- Centralise governance for human, machine, and agentic identities Inventory who or what can create, reuse, or delegate access across those identity classes, then close the gaps where ownership, offboarding, or approval is unclear.
- Shrink cross-surface credential blast radius Limit OAuth scope, API key reuse, and browser-session reach so a single compromise cannot pivot freely from initial access into adjacent systems.
Key takeaways
- AI-driven attack speed is now compressing the window for containment, which makes identity events more operationally important than isolated malware alerts.
- The report's evidence points to identity weakness and cross-surface complexity as the conditions that let breaches spread quickly across cloud, SaaS, browsers, and endpoints.
- Practitioners should focus on reducing trust reuse, shrinking credential blast radius, and shortening the path from identity detection to containment.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK define the specific risk controls and attack patterns relevant to this term.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | Identity-based initial access and credential misuse dominate the report's breach pattern. |
| NHI-05 — Overprivileged NHI | Cross-surface movement depends on excessive access scope that lets identity artefacts travel. | |
| NHI-07 — Long-Lived Secrets | Reusable credentials and tokens remain exploitable long enough to support multi-stage attacks. | |
| Recommendation — Harden authentication paths that attackers can abuse through credential misuse and identity-based entry. Reduce access scope so reused credentials and tokens cannot pivot across environments. Shorten secret lifetime and revoke stale credentials before they can be reused in later attack stages. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | The report centers on credential abuse followed by movement across multiple surfaces. |
| Recommendation — Map identity abuse to credential access and lateral movement tactics to prioritize detection and containment. | ||
Key terms
- Cross-Surface Identity Attack: An attack that moves across multiple identity and application planes instead of staying inside one system. The security challenge is not the individual alert in each plane, but the sequence that only becomes visible when those alerts are correlated into one behavioural path.
- Identity-based initial access: Initial access gained through misuse of accounts, passwords, sessions, tokens, or social engineering rather than by exploiting software flaws first. In practice, it means the attacker enters through trust relationships already embedded in the identity layer, which makes the compromise look legitimate until abuse begins.
- Implicit trust: The assumption that an authenticated user, token, or session should continue to be trusted across time and systems without repeated checks. In modern environments, this assumption creates attack leverage because identity artefacts can be reused, delegated, or moved faster than manual governance can react.
- Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.
Published by the NHIMG editorial team on June 7, 2026.
Updated on October 8, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org