Credential abuse and lateral movement expose cloud identity gaps

At a glance

What this is: This threat advisory argues that cloud breaches often start with trusted credentials and then spread through privilege escalation and lateral movement across connected systems.

Why it matters: IAM, PAM, and NHI teams should treat identity containment and segmentation as breach-limiting controls, not just authentication hygiene.

Context

Cloud identity gaps emerge when a valid account, token, or session can still reach too much of the environment after compromise or misuse. In this advisory, the core issue is not initial access alone, but the way trusted identities allow attackers or insiders to move beyond the first foothold.

For IAM and NHI programmes, that means access scope, session visibility, privilege separation, and network containment have to work together. If credentials remain valid after role change, offboarding, or compromise, the identity layer becomes the bridge from one system to many.

Key questions

Q: What breaks when a valid cloud credential is abused for lateral movement?

A: The control that breaks is trust in the first authenticated session. Once an attacker or insider can use a valid identity to reach mail, storage, and administrative workflows, the environment has lost containment. The practical failure is not login bypass, but access scope that remains broad enough to let one account become a launch point for wider compromise.

Q: Why do stale accounts make credential compromise worse?

A: Stale accounts extend the time an attacker can use a valid password without raising suspicion. They often bypass the normal attention given to active users, yet still retain authentication paths and sometimes privileged entitlements. That makes them an efficient entry point when exposed credentials are circulating in breach data.

Q: How do security teams know whether containment is actually working?

A: They should test whether the identity can still execute privileged actions after revocation, not just whether the API call succeeded. A working containment model prevents re-escalation, blocks credential regeneration, and remains effective even when the target is polling for state changes. If any of those fail, containment is only partial.

Q: How should organisations combine segmentation and least privilege in cloud environments?

A: Use least privilege to limit what an identity can do, then use segmentation to limit where that identity can go if it is abused. The two controls solve different problems. Least privilege reduces permission scope, while segmentation contains spread across systems, which is essential when cloud identities are already trusted by design.

Technical breakdown

How credential abuse becomes lateral movement in cloud environments

Credential abuse begins when an attacker or insider uses a valid login, token, or inherited permission rather than breaking authentication outright. Once inside, lateral movement occurs when that identity can reach additional applications, mailboxes, storage, or administrative functions without a second containment barrier. Cloud environments make this easier because identities, workflows, and SaaS integrations are tightly connected. The advisory's examples show that phishing, stale access, and exposed repositories all become more dangerous when the first credential can fan out into broader operational reach. This is why the exploit path is often quiet until privilege changes or unusual data access reveal it.

Practical implication: map which identities can move across business functions after first compromise and add containment boundaries before those paths are used.

Why standing privilege and weak identity hygiene extend dwell time

Standing privilege means an account keeps access after the task, role, or relationship that justified it has changed. In practice, this is what lets an old employee credential, a rogue authenticator, or a newly enrolled device remain useful long after it should have been revoked. Weak identity hygiene includes stale accounts, overbroad roles, missing offboarding, and inconsistent MFA enforcement. The article's insider and gift card cases show that attackers do not need exotic techniques when identity lifecycle controls lag behind actual usage. The longer the access survives, the more time the attacker has to study workflows and blend in.

Practical implication: treat offboarding, role change, and authenticator enrolment as security events, not administrative chores.

How microsegmentation limits the blast radius of one compromised identity

Microsegmentation reduces the number of systems that any single identity can touch, even when that identity is valid. It works by separating high-value workflows, such as financial operations, gift card issuance, and sensitive repositories, from routine access paths. That matters because cloud attackers often do not need malware or noisy exploitation once they have a trusted credential. They only need enough reach to pivot, observe, and act inside connected systems. When segmentation is absent, one compromised account can become an enterprise-wide foothold. When it is present, the attacker's movement is constrained to a narrower, more detectable segment.

Practical implication: segment business-critical cloud workflows so a compromised user or service identity cannot traverse the full environment.

Threat narrative

Attacker objective: The objective is to turn a trusted identity into sustained access that enables fraud, data exposure, and wider compromise without triggering immediate detection.

1. Entry occurs through phishing, smishing, stale employee credentials, or leaked access tokens that give the attacker a trusted foothold.
2. Credential access and privilege escalation follow as the attacker registers rogue authenticators, enrolls devices, or inherits broader access through weak controls.
3. Lateral movement then continues through connected cloud services, email forwarding, storage access, and workflow abuse until the actor can generate fraud or reach sensitive data.
4. Impact appears as data exposure, unauthorized gift card issuance, persistence for months, or the ability to use the environment for additional malicious operations.

Breaches seen in the wild

• SonicWall SSL VPN account compromises 2025: Attackers used valid credentials to log in to more than 100 SonicWall SSL VPN accounts across 16 environments in October 2025.
• Storm-2949 Azure Breach: Storm-2949 social engineering attack turns one cloud identity compromise into full Azure tenant breach.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Credential abuse is now the primary cloud compromise pattern, not a side effect of intrusion. The article's examples all start with a trusted identity and then expand through the environment because cloud access is already highly interconnected. That means the control problem is identity scope, not just authentication strength. Practitioners should treat valid credential misuse as the normal path they have to contain.

Identity blast radius is the right concept for cloud compromise. A credential is not just a login artifact. It is a permissions bundle that can expose data, workflows, and administration paths if segmentation and privilege separation are weak. The practitioner implication is to measure how far a compromised identity can move before it is blocked.

Standing access outlives the business event that justified it. Old credentials, unenforced offboarding, and unmanaged device or authenticator enrolment create persistence opportunities that basic detection cannot erase after the fact. The governance failure is lifecycle lag, where access remains usable after employment, role, or trust has changed. Practitioners need to govern revocation as tightly as issuance.

Microsegmentation is an identity control as much as a network control. The advisory shows that containment, not just monitoring, determines whether one compromised account becomes enterprise spread. Separating critical workflows from routine access paths narrows the attacker's operating space and makes lateral movement visible sooner. Security teams should align segmentation with identity privilege paths, not just infrastructure zones.

From our research library:

• Valid account abuse was responsible for 35% of cloud-related incidents, according to CrowdStrike's 2025 Global Threat Report.

What this signals

Identity containment needs to be designed around business workflows, not just user roles. Cloud compromise often spreads because the same identity can still touch email, storage, and operational systems after the first login. Programme teams should therefore test the actual movement paths a compromised identity can take, then break those paths with segmentation and tighter privilege boundaries.

Credential abuse is a lifecycle problem as much as a detection problem. When offboarding, device enrolment, and authenticator governance lag behind usage, the attacker inherits a valid trust relationship instead of breaking one. Teams that want faster containment should treat revocation, enrolment review, and forwarding-rule monitoring as part of the same control plane.

Microsegmentation should be evaluated as an identity control outcome. If a cloud account can still reach high-value workflows after compromise, the environment remains too connected. The question for practitioners is not whether segmentation exists, but whether it materially reduces the identity blast radius.

For practitioners

• Map cloud identity blast radius Inventory which human, service, and privileged identities can reach financial workflows, storage, and administrative functions after one compromise. Use that map to find identities that can pivot across more than one business domain.
• Tighten identity lifecycle offboarding Revoke stale accounts, old credentials, and orphaned authenticator registrations as part of offboarding and role change, not after the next review cycle. Include employees, contractors, and third-party access paths.
• Segment high-value cloud workflows Separate gift card issuance, sensitive repositories, and financial systems from routine user access paths so a single compromised credential cannot traverse the full environment.
• Monitor for abnormal identity enrolment Alert on new device enrolments, rogue authenticator registrations, unusual email forwarding, and privilege changes that expand reach after login. These are early indicators that trusted access is being repurposed.

Key takeaways

• Valid cloud credentials can become a breach path when access scope, not login strength, is the real weakness.
• The article's examples show that attackers can persist for months when lifecycle controls, privilege separation, and segmentation are weak.
• Limiting the blast radius of a compromised identity is the control that most directly turns broad compromise into a contained incident.

Key terms

• Credential Abuse: Credential abuse is the use of valid secrets or accounts by an unauthorised party or for unauthorised purposes. In practice, it often looks like normal authentication unless teams correlate context, privilege, and behaviour. It is one of the most persistent ways identity failures become breaches.
• Lateral Movement: A post-compromise technique where an attacker uses a compromised NHI to move through a network, accessing additional systems and escalating impact without triggering detection.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
• Microsegmentation: A network control approach that divides environments into small security zones with explicit rules between them. Its purpose is to limit lateral movement and reduce blast radius when an identity, workload, or device is compromised.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.