Cyber conflict attribution is becoming an identity problem

At a glance

What this is: This is a podcast discussion arguing that cyber conflict attribution is inseparable from identity, authority, and campaign intent, not just tooling and malware.

Why it matters: IAM and security teams need attribution context to understand delegated action, prioritise response, and align identity governance with how modern campaigns are actually directed.

Context

Cyber conflict attribution is the practice of determining who is behind an operation, what they are trying to achieve, and how their methods fit into a broader campaign. The problem is that defenders often stop at malware analysis and lose the strategic context that changes how incidents should be interpreted.

For identity practitioners, the relevant question is not only what ran or where it executed, but under whose authority it acted and how delegation shaped the operation. That matters across human identity, non-human identity, and autonomous systems because campaigns increasingly rely on layered access, borrowed authority, and plausible deniability.

The article frames attribution as a governance problem as much as a threat-intelligence problem. That is a typical starting point for cross-domain identity analysis, because the same ambiguity that complicates cyber conflict also complicates access ownership, delegated trust, and response accountability.

Key questions

Q: How should security teams attribute cyber operations when identity and authority are delegated across systems?

A: Start by mapping the authority chain, not just the attack chain. Security teams need to know which human, machine, or automated identity initiated the action, which identity extended it, and which evidence supports the claimed intent. Attribution becomes more reliable when delegated access is treated as part of the incident record, not an afterthought.

Q: Why does attribution change how defenders prioritise response and forecasting?

A: Because attribution links an incident to a likely objective, not just a technical footprint. If the operation looks like espionage, disruption, or influence activity, responders should expect different follow-on actions, different target sets, and different urgency. Without that context, teams may overfocus on containment and miss what the adversary is trying to achieve next.

Q: What breaks when teams treat cyber conflict as isolated malware events?

A: They lose the campaign context that explains why the attack happened and what may follow. Malware-only analysis can identify tooling, but it cannot reliably distinguish pressure, intelligence collection, or influence operations. That gap produces weak prioritisation, slower strategic response, and poor forecasting of attacker behaviour.

Q: What should teams do when attribution confidence is still low?

A: Keep technical evidence and attribution claims separate until the evidence chain is stable. Teams should preserve indicators, log the reasoning that supports any tentative actor assessment, and avoid presenting a low-confidence hypothesis as fact. That discipline matters most when false flags, AI-generated noise, or ambiguous access paths are in play.

Technical breakdown

Attribution links technical evidence to campaign intent

Attribution is the process of connecting indicators, infrastructure, and behaviour to an actor, then reading those signals against motive and objective. In conflict settings, that context separates disruption, espionage, and influence operations even when the malware or infrastructure looks similar. The technical evidence still matters, but it is only one layer in a larger interpretation problem. Without attribution, defenders often overreact to the artifact and underreact to the campaign. Practical implication: build triage around actor context, not only around the malware family or initial access vector.

Practical implication: build triage around actor context, not only around the malware family or initial access vector.

Identity and delegated authority shape how campaigns are executed

Modern campaigns rarely depend on a single isolated operator. They rely on identity, delegated access, and organisational authority, whether that is a human analyst, a service account, or an automated system acting with permission. That makes attribution an identity problem because the question becomes who legitimately held the authority to act, who borrowed it, and how that authority was chained across systems. When authority is delegated, the visible action may belong to one actor while the strategic intent belongs to another. Practical implication: map authority chains before you assume a single actor explains the operation.

Practical implication: map authority chains before you assume a single actor explains the operation.

AI lowers the cost of deception and raises attribution uncertainty

The article’s AI discussion matters because deceptive activity becomes cheaper when tooling can imitate behaviour, generate noise, or accelerate false narratives. That does not make attribution impossible, but it does make confidence harder to earn and easier to manipulate. Security teams should expect more ambiguity in the signals they receive and more pressure to separate genuine operational evidence from misleading surface activity. Practical implication: treat confidence levels as part of the incident record, and resist overcommitting to attribution before the evidence chain is stable.

Practical implication: treat confidence levels as part of the incident record, and resist overcommitting to attribution before the evidence chain is stable.

Breaches seen in the wild

• CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Attribution is now an identity governance question, not just a threat-intelligence one. The article is right to treat cyber conflict as a matter of who exercised authority, not only what code executed. Once operations are understood as delegated action inside a broader campaign, identity becomes part of the strategic picture. That means practitioners need to think about authority chains, not just telemetry, when explaining hostile activity.

Cyber campaigns expose the limits of event-by-event security models. Defenders who isolate one alert from its campaign context miss the political intent that often determines target selection, sequencing, and escalation. This is where identity context matters: the same access path can support espionage, disruption, or influence depending on who is driving it. The implication is that identity programmes and threat programmes should share an actor model.

Delegated authority drift: The article surfaces a useful concept for modern identity governance. When authority is borrowed across humans, service identities, and automation, the recorded actor and the strategic actor can diverge. That divergence is now a core interpretive risk, and practitioners should treat it as a standing assumption in incident analysis.

AI does not erase attribution, but it does collapse the margin for error. As false signals become cheaper to generate, teams must become stricter about evidence quality and confidence language. In practice, this pushes IAM, security operations, and intelligence teams toward shared definitions of who acted, under what authority, and with what confidence level. That is the new baseline for defensible attribution.

What this signals

Delegated identity is now part of the attribution problem. Campaigns increasingly move through layers of borrowed authority, which means the visible actor and the strategically responsible actor may not be the same. For practitioners, that makes authority chains a core input to incident interpretation rather than an audit afterthought.

The most practical shift is to align SOC, IAM, and threat-intelligence views around actor, authority, and intent. If those three are not captured together, defenders will keep confusing technical events with campaign strategy and will make response decisions on incomplete evidence.

For practitioners

• Map authority chains across critical operations Document which human, non-human, and automated identities can initiate, approve, or extend access during a campaign-relevant workflow. The goal is to show who can act on behalf of whom when attribution matters most.
• Separate indicators from intent in incident reviews Record technical evidence and inferred motive as distinct fields so responders do not collapse malware artefacts into attribution claims. This improves decision quality when operations are ambiguous or deliberately deceptive.
• Set confidence thresholds for attribution claims Require an explicit confidence level before an incident is labelled as espionage, disruption, or influence activity. The standard should be high enough to prevent narrative drift from driving operational decisions.
• Include delegated identity in threat models Model service accounts, tokens, and automated workflows as part of the actor chain, not just as plumbing. That lets teams see how authority is transferred, reused, or obscured inside a broader operation.

Key takeaways

• Cyber conflict analysis becomes weaker when teams stop at malware and ignore the authority structure behind the operation.
• Attribution matters because it changes how defenders interpret intent, likely targets, and the next move in a campaign.
• Identity, delegation, and confidence handling should sit inside incident review if organisations want more defensible response decisions.

Key terms

• Attribution: Attribution is the ability to prove which identity performed a specific action, through which systems, and with what outcome. In agentic environments, attribution must span APIs, services, and workflow steps, because isolated logs are rarely enough to reconstruct decision chains or support audit and incident response.
• Campaign context: Campaign context is the broader operational or strategic setting that gives an incident its meaning. It helps defenders decide whether an event is disruption, collection, or influence, and it prevents isolated technical signals from being misread as the whole story.
• Delegation authority: Delegation authority is the right for one identity to act on behalf of another within a defined scope. For agents, it must be explicit, time-bound, and auditable because the system may initiate actions independently once granted access.
• Confidence Level: Confidence level is the signal quality indicator that shows how reliable a proximity result is. It helps security and fraud teams separate strong location evidence from weaker matches caused by limited device data or degraded positioning quality. This makes proximity-based decisions easier to tune and less likely to overreact to noise.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.