TL;DR: Cyber resilience in 2026 depends on shifting from project-based security to continuous privileged access control, as ransomware incidents rose more than 53% year over year, unmanaged devices carried corporate logins in 46% of cases, and leaked secrets took a median 94 days to fix, according to Fudo Security. The governance gap is not awareness but persistence: dormant accounts, unmanaged credentials, and broad access outlast the controls meant to contain them.
At a glance
What this is: This is an analysis of why continuous privileged access control is becoming the core resilience model for 2026, with the key finding that static, project-based security leaves dormant accounts, unmanaged credentials, and broad access in place long after the risk has shifted.
Why it matters: It matters because IAM, PAM, and NHI programmes now have to be run as always-on resilience controls, not periodic compliance exercises, if they are to limit breach blast radius and recovery time.
By the numbers:
- 2025 saw a 53% year-over-year increase in ransomware victims to over 7,960 on double-extortion leak sites.
- Educational institutions faced an average of 4,352 attacks per organisation weekly.
- Verizon found that 46% of compromised systems containing corporate logins were unmanaged devices.
- The median time to remediate exposed secrets was 94 days.
Context
Cyber resilience in this article means more than preventing compromise. The core problem is that many organisations still treat privileged access, secrets, patching, and offboarding as separate projects rather than as one continuous governance model.
The article argues that this project-based posture breaks down when attackers work through dormant accounts, leaked secrets, unmanaged devices, and delayed remediation. In IAM and PAM terms, the issue is not just access control design but the operational persistence of access that should no longer exist.
NIS2 and DORA are presented as catalysts for a broader shift toward continuous accountability. The practical question for practitioners is whether privileged access control is enforced as an always-on resilience function or only as a periodic compliance task.
Key questions
A: Privileged access breaks down when it is handled as a short-term implementation rather than a living control. Standing access, weak review cycles, and inconsistent exception handling create drift. Over time, that drift expands blast radius, slows investigations, and makes it harder to prove who had access, why they had it, and whether that access was still justified.
Q: Why do leaked secrets and dormant accounts increase ransomware risk?
A: They preserve valid access after the organisation has stopped paying attention to them. Attackers can use the credential or account as a low-noise entry point, then pivot into broader compromise before defenders notice. The risk rises because the access is still trusted even when the context that created it is gone.
Q: How can security teams tell whether privileged access reviews are actually working?
A: They are working when every privileged entitlement is inventoried, every decision is traceable, and revoked access is removed from all connected systems without delay. If the organisation can only show approvals but not downstream revocation, the review is administrative recordkeeping rather than governance. Proof of removal is the best maturity signal.
Q: How can organisations secure third-party privileged access in hybrid environments?
A: Require suppliers to use time-limited access, monitor every session, and restrict them to the minimum systems needed for support. Do not treat vendor access as a permanent exception. It should be governed like any other high-risk identity, with ownership, approvals, and offboarding built in.
Technical breakdown
Why project-based privileged access control fails under continuous attack
Project-based security assumes there is a stable window for patching, review, and clean-up before attackers return. That assumption fails when privileged access, exposed secrets, and unmanaged endpoints remain usable for weeks or months. In practice, the attack surface is not fixed between audits, and the control problem becomes one of persistence rather than one-time hardening. Continuous privileged access control is therefore a governance model, not a product category. It connects account lifecycle, session oversight, and entitlement scope into one operating posture so that access does not outlive the business need that created it.
Practical implication: move privileged access decisions into continuous control cycles instead of treating them as quarterly hygiene tasks.
Why dormant accounts and leaked secrets extend breach windows
Dormant accounts and leaked secrets are high-value because they preserve valid authentication after the original owner has stopped paying attention. A secret copied into a public repository or an account left active after offboarding can still be used long after discovery, which is why the article emphasises long remediation delays. This is not only a secrets problem, it is a lifecycle problem: the credential remains authoritative until someone revokes it, rotates it, or removes the account entirely. The security failure is therefore persistence of trust after exposure.
Practical implication: tie secret discovery to immediate revocation and offboarding so exposed credentials do not remain valid by default.
How unmanaged devices and broad third-party access break resilience
The article links unmanaged devices and overbroad third-party access to a larger resilience gap because access from untrusted endpoints is difficult to observe, constrain, and trace. When external users or contractors receive broad access without centralized permission visibility, incident response starts from a weaker position. Security teams then struggle to reconstruct who had access, from where, and for how long. That is why privileged access governance has to cover session control, supplier access, and device posture together rather than as separate workstreams.
Practical implication: require centralized session oversight and scoped third-party access before extending privileged access to external users or unmanaged endpoints.
Threat narrative
Attacker objective: The attacker’s objective is to turn stale privileged access into a durable foothold that supports ransomware, credential reuse, or deeper environment compromise.
- Entry begins with credential theft, leaked secrets, or use of unmanaged devices that already contain corporate logins.
- Escalation occurs when dormant or overprivileged accounts provide valid access beyond the original business need.
- Impact follows when attackers use that access to move from initial compromise into ransomware, data theft, or prolonged unauthorized control.
Breaches seen in the wild
- Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Continuous privileged access control is now a resilience discipline, not an access administration task. The article is right to connect PAM with cyber resilience because access governance now sits on the same critical path as detection and recovery. If privileged access remains broad, stale, or invisible, resilience fails before response even starts. Practitioners need to treat privileged access as an operational continuity control, not a back-office entitlement process.
Persistent trust is the real failure mode behind dormant accounts and leaked secrets. These conditions remain dangerous because they preserve authority after the original trust event has expired. The problem is not simply that credentials exist, but that the organisation continues to accept them as valid long after the context that justified them is gone. The practical conclusion is that lifecycle governance has to be continuous if the access model is to stay trustworthy.
Centralised visibility over privileged access is becoming a board-level resilience requirement. The article’s linkage of NIS2 and DORA to cyber resilience reflects a wider market shift toward accountable access governance. Boards do not need more tool sprawl, they need evidence that privileged access is constrained, reviewed, and traceable across employees, contractors, and suppliers. That is where resilience becomes measurable.
Identity blast radius is the concept practitioners should watch. When unmanaged devices, leaked secrets, and broad access combine, the scope of a single compromise expands far beyond the initial account. This is the security value of continuous privileged access control: it reduces how far one credential can travel before it is detected or revoked. The field should now measure resilience by how much identity blast radius can be contained after exposure.
What this signals
Identity blast radius: The article points to a governance shift from stopping every intrusion to limiting how far any one credential can travel once exposed. That means resilience programmes need stronger linkage between privileged access scope, offboarding, and session traceability.
Continuous privileged access control also changes how teams think about accountability. If access reviews, secret revocation, and contractor oversight are still run as discrete tasks, the organisation will keep discovering that the strongest control arrived after the attacker already used the access.
NIS2 and DORA are best understood here as forcing functions for operational discipline. They do not replace privileged access governance, but they make weak lifecycle control and poor access visibility harder to justify in board reporting.
For practitioners
- Map privileged access to every dormant account Identify accounts that no longer have an active business owner, a current use case, or a recorded review outcome. Remove or reauthorise them before they become the easiest path for re-entry.
- Shorten the exposure window for leaked secrets Treat exposed API keys, tokens, and other secrets as a revocation event, not a ticket backlog item. Track discovery to invalidation as a single operational metric.
- Centralise third-party privileged access oversight Require one control point for contractor and supplier sessions so you can see who accessed what, from where, and under which entitlement. Do not rely on scattered application-level logs to reconstruct accountability.
- Enforce unmanaged device restrictions for privileged sessions Block high-risk access from endpoints that cannot be inspected, controlled, or tied to corporate policy. If a device cannot be trusted, its privileged session should not inherit full production access.
- Tie resilience reporting to access lifecycle evidence Use offboarding completion, secret revocation, and session traceability as resilience indicators. A programme that cannot show these events is not yet operating as continuous privileged access control.
Key takeaways
- The article frames cyber resilience as a privileged access problem as much as a detection or recovery problem.
- Its evidence points to long-lived access exposures, including leaked secrets, unmanaged devices, and dormant accounts.
- The practical response is continuous control over access lifecycle, session visibility, and revocation, not periodic security projects.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack surface, NIST SP 800-53 Rev 5 sets the technical controls, and DORA and NIS2 define the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | The article centres on broad privileged access that weakens resilience when it persists too long. |
| NHI-01 — Improper Offboarding | Dormant accounts and incomplete offboarding are explicit failure modes in the article. | |
| NHI-07 — Long-Lived Secrets | The article highlights leaked secrets that stay usable for months before remediation. | |
| Recommendation — Reduce standing privilege and constrain privileged access scope to the minimum business need. Remove or disable accounts when the business relationship ends and verify offboarding completion. Shorten secret lifetime and revoke exposed credentials immediately after discovery. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | The article focuses on credential lifecycle, rotation, and revocation for privileged access. |
| Recommendation — Apply authenticator lifecycle controls to rotate and revoke privileged credentials without delay. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | The threat pattern described depends on credential theft and later movement through trusted access. |
| Recommendation — Map leaked secrets and unmanaged logins to credential-access and lateral-movement detections. | ||
| DORA | ICT risk management | The article explicitly uses DORA as a resilience and accountability reference for financial organisations. |
| Recommendation — Align privileged access governance with ICT risk management and resilience testing expectations. | ||
| NIS2 | Risk management measures | The article ties cyber resilience to NIS2 obligations around access policies and identity management. |
| Recommendation — Use NIS2 risk management obligations to justify continuous access policy enforcement and supplier oversight. | ||
Key terms
- Runtime Privileged Access Control: The practice of governing what an actor can do during an active privileged session, not just whether the session was approved. It shifts enforcement from credential issuance to session behavior, which is critical when attackers can abuse valid access after login.
- Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
- Dormant account: A dormant account is an identity that has not been used within a defined period but still retains active access. The risk is not only wasted licensing. Dormant access often becomes stale standing privilege, which makes offboarding, certification, and incident response harder to execute cleanly.
- Leaked Secret: A leaked secret is any credential or key that becomes exposed outside its intended trust boundary, whether through code, logs, repositories, misconfiguration, or disclosure. The operational concern is not just exposure, but the speed at which the secret can be identified, revoked, and replaced before abuse occurs.
Deepen your knowledge
NHI governance, machine identity security, and identity lifecycle management are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM or PAM programme, it is worth exploring.
Published by the NHIMG editorial team on July 8, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org