Cyber resilience is becoming the baseline for 2026 planning

At a glance

What this is: Illumio frames cyber resilience as the new baseline for 2026, arguing that organisations should plan for breach containment and operational continuity rather than relying on prevention alone.

Why it matters: IAM, PAM, NHI, and agentic AI programmes all depend on limiting blast radius when trust fails, so resilience planning now has direct implications for access control, segmentation, and accountability.

Context

Cyber resilience is the ability to keep critical services operating when prevention fails. The article treats that as a governance shift, not just a technical one: organisations are being forced to plan for breach containment, operational continuity, and clearer ownership of risk. That matters for identity programmes because access, privilege, and delegation decisions directly shape how far an incident can spread.

The article uses the St. Paul ransomware shutdown as a practical example of why incident scope now matters as much as incident prevention. Once systems go offline, the question becomes how quickly access can be constrained, how well segmentation holds, and who is accountable when business operations are disrupted. For IAM and NHI teams, that means resilience is increasingly part of identity governance, not a separate concern.

Key questions

Q: What fails when organisations rely on prevention instead of containment?

A: Prevention-only strategies fail when an attacker gets past the first control, because broad connectivity and standing privilege let the incident spread faster than defenders can respond. Containment limits blast radius, protects critical services, and preserves operational continuity even when one identity, host, or supplier account is compromised.

Q: Why do service accounts and AI agents need different controls from human users?

A: Service accounts and AI agents authenticate and act without the predictable patterns that human identity systems expect. They can operate across runtimes, scale quickly, and carry permissions into automated workflows. That means access decisions should consider workload context, runtime behaviour, and time-bound authority rather than relying only on user-centric IAM patterns.

Q: What are the signs that Zero Trust is not actually containing incidents?

A: Common signs include lateral movement across supposedly separate zones, service accounts reaching systems they should not touch, and incidents that force broad shutdowns instead of local isolation. If an attack on one workload still threatens core operations, segmentation and verification are not holding up under real conditions.

Q: How should boards hold security teams accountable for resilience?

A: Boards should ask for evidence of containment, recovery, and service continuity, not just prevention metrics or compliance status. That means tracking how much business impact a cyber incident can create, who owns the control failures, and whether identity, network, and operational teams share responsibility for reducing exposure.

Technical breakdown

Why containment now matters more than prevention alone

Containment is the control objective that limits how far an attacker can move once initial access exists. In modern environments, flat trust, broad connectivity, and excessive privileges let a single compromise become an enterprise event. That is why resilience planning increasingly focuses on segmentation, continuous verification, and reducing reachable paths rather than assuming detection will arrive first. The same logic applies to human and non-human identities: if credentials, tokens, or service accounts can reach too much, the incident expands faster than security teams can respond.

Practical implication: design access paths so a single compromised identity cannot fan out across critical systems.

How agentic AI and API sprawl change the identity problem

Agentic AI expands the number of runtime actors that can authenticate, call APIs, and trigger downstream actions. That creates identity ambiguity because actions may be executed automatically using usernames, passwords, or tokens that appear to belong to a person but are really being exercised by software. As these connections multiply, teams lose visibility into who or what is acting, which makes audit, containment, and incident scoping harder. This is an NHI governance issue as much as an AI issue because the real control point is the identity and privilege granted to the agent.

Practical implication: govern AI agents as non-human identities with scoped access, explicit ownership, and revocation paths.

Why Zero Trust becomes operational infrastructure

Zero Trust is moving from a policy label to an architectural default. At a technical level, that means least privilege, segmentation by design, and continuous verification are built into the environment rather than layered on after deployment. The important shift is that these controls are no longer only about security architecture. They are now part of business continuity because they determine whether an attack is contained, whether operations stay up, and whether recovery is manageable. In that sense, Zero Trust becomes the mechanism that turns resilience from aspiration into operating practice.

Practical implication: treat continuous verification and segmentation as uptime controls, not just access controls.

Threat narrative

Attacker objective: The objective is to convert a single compromise into broad operational disruption and leverage that disruption for maximum business and societal impact.

1. Entry occurs when attackers gain a foothold through trusted access, supply chain compromise, or exposed credentials and then move into systems that matter operationally.
2. Escalation follows when broad permissions, connected services, or poorly segmented environments let the attacker extend reach beyond the initial target.
3. Impact arrives when the attacker can disrupt services at scale, forcing shutdowns, public safety interruptions, or business continuity failures.

Breaches seen in the wild

• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
• CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Cyber resilience is now an identity governance problem, not only a security architecture problem. When organisations ask what happens after a breach, the answer is often determined by who or what had standing access in the first place. Excessive privilege, weak segmentation, and unmanaged non-human identities turn a contained event into an operational outage. Practitioners should treat blast radius as a governance metric, not just a technical outcome.

Agentic AI will force security teams to govern runtime actors as non-human identities. The article’s discussion of agents using credentials and tokens points to a broader issue: software that acts on behalf of people can inherit trust faster than controls can classify it. That creates a verification gap for identity, ownership, and revocation. Teams should assume that AI-driven actions need explicit identity boundaries, not informal proxy trust.

Zero Trust is becoming the practical control plane for resilience. The article is not arguing for a new theory of security; it is showing that continuous verification and segmentation now decide whether the business keeps operating. In identity terms, that elevates access scope, session boundaries, and privilege containment to board-level resilience topics. Practitioners should align IAM, PAM, and NHI governance to the same continuity objective.

Board accountability will reshape how security priorities are funded and measured. Once cyber risk is framed in financial and operational terms, resilience stops being a security-team preference and becomes an executive obligation. That changes how identity programmes are justified because access governance now influences operational continuity, not only compliance. Practitioners should expect stronger scrutiny on the controls that limit incident spread.

Regulation will continue to matter, but it will not substitute for containment. The article’s central warning is that compliance can lag the threat while attackers exploit the gap. That is especially relevant in identity-heavy environments where third-party access, service accounts, and agentic systems create hidden exposure. Practitioners should use frameworks like NIST CSF and Zero Trust as operational guardrails, not check-box proof of safety.

What this signals

Blast-radius control is becoming the governing principle of cyber resilience. As attacks move faster than prevention cycles, the practical measure of programme maturity is whether a compromise stays local or becomes an enterprise outage. Identity, segmentation, and runtime verification now need to be managed as one containment system, not as separate initiatives.

Non-human identity governance now sits inside resilience planning. Agentic systems, service accounts, and API tokens are not peripheral controls anymore because they determine how quickly an incident can propagate. If those identities are over-scoped, the recovery problem starts before the incident is even declared.

For practitioners

• Build for containment first Map critical systems to the smallest practical trust zones and verify that a compromise in one zone cannot reach core services unchecked.
• Inventory non-human access paths Catalogue service accounts, tokens, and AI agent credentials that can initiate actions across applications and APIs, then assign clear owners and revocation processes.
• Test operational continuity under attack Run scenario exercises that assume ransomware, supplier compromise, or identity abuse has already occurred and measure how quickly critical services can be isolated.
• Tie resilience metrics to executive reporting Report containment time, service impact, and recovery dependencies alongside traditional security metrics so leadership can see business exposure rather than only control counts.

Key takeaways

• Cyber resilience is shifting from a secondary security goal to the baseline that determines whether organisations can keep operating during an attack.
• The article links that shift to containment, segmentation, AI-driven complexity, and board accountability rather than to prevention alone.
• For IAM and NHI teams, the practical priority is reducing blast radius by tightening access scope, ownership, and revocation across human and machine identities.

Key terms

• Cyber Resilience: Cyber resilience is the ability to continue operating, recover, and make safe decisions during and after a cyber incident. It goes beyond backup availability by combining visibility, prioritisation, and restoration discipline so the organisation can restore what matters without amplifying harm.
• Blast Radius: The potential scope of damage if a specific credential or identity is compromised. Identities with broad permissions have a larger blast radius and represent a higher priority for least-privilege enforcement and security controls.
• Containment: The phase of incident response that stops an incident from spreading while preserving the evidence needed to investigate it. In cloud environments, containment often starts with identity revocation, isolation of workloads, and protection of logs before any system is terminated or cleaned up.
• Agentic AI Identity: The complete set of credentials, permissions, and governance controls applied to an autonomous AI agent, covering authentication, authorisation, action logging, and access revocation. Distinct from traditional NHI because agent identities are often ephemeral, delegated, and multi-hop.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps security and identity practitioners connect access control decisions to operational resilience.