TL;DR: Cyber resilience is a business continuity problem, not just a prevention problem, according to Semperis, with the article arguing that identity systems, especially Active Directory, create the largest blast radius when defenders cannot restore trust quickly. The operational lesson is that recovery, delegation, and communication planning now matter as much as perimeter defence.
At a glance
What this is: Semperis argues that cyber resilience now sits at the intersection of business continuity, identity recovery, and crisis leadership, with Active Directory singled out as a high-blast-radius dependency.
Why it matters: For IAM and PAM teams, the message is that identity recovery, delegated authority, and restore trust processes are continuity controls, not just technical cleanup tasks.
Context
Cyber resilience is the ability to keep critical services operating, or restore them with integrity, after disruption. In this article, the governance gap is that many organisations still treat cyber as an IT issue even though recovery decisions now cut across operations, communications, legal, finance, and customer trust.
The identity angle is direct. When identity infrastructure becomes untrusted or unavailable, recovery is no longer just about system uptime, because access control, delegation, and trust restoration determine whether the business can safely resume. That makes identity governance part of resilience planning, not a separate technical workstream.
Key questions
Q: What breaks when identity continuity is not built into resilience planning?
A: When identity continuity is missing, authentication, authorization, and session management all become fragile at the same time. Users lose access, emergency access expands, and auditability drops just when control matters most. The organisation ends up restoring operations by weakening the very controls it relies on for trust.
Q: Why do identity systems increase the impact of a cyberattack?
A: Identity systems increase impact because they concentrate the permissions that control many downstream services, users, and administrative actions. If attackers corrupt or exploit that layer, the blast radius reaches far beyond the initial point of compromise. The same trust relationships that make operations efficient also make recovery harder when the identity foundation is no longer reliable.
Q: How do you know if identity recovery testing is actually working?
A: Use full restore drills that validate behaviour, not just data presence. A successful test should prove that users authenticate, applications receive access correctly, and automation still works after rollback. If the team still needs manual fixes, the recovery design is incomplete.
Q: Who should own emergency authority when cyber resilience depends on identity?
A: Emergency authority should sit with clearly named business and technical leaders who can prioritise services, approve privileged actions, and coordinate communication when normal controls are impaired. Ownership must be defined before an incident because delegated access, not improvisation, determines whether recovery stays within trusted boundaries. This is a governance issue as much as an incident response issue.
Technical breakdown
Why identity systems create the largest blast radius
Identity systems sit underneath authentication, authorisation, and service continuity, so compromise or corruption there affects far more than a single application. Active Directory is especially sensitive because many enterprise controls depend on its trust relationships, group membership, and recovery pathways. If attackers can manipulate or damage that foundation, every connected workload inherits the uncertainty. Resilience therefore depends on both containment and the ability to re-establish trust in identity state, not merely on restoring servers from backup.
Practical implication: Treat identity infrastructure as a recovery-critical dependency and validate that restoration can re-establish trust, not just bring directories back online.
Assume breach and restore trust under pressure
An assume-breach posture accepts that prevention will fail somewhere and shifts the question to how fast the organisation can recover with integrity. In identity terms, that means knowing what is authoritative, who can delegate emergency authority, and how to distinguish clean access paths from compromised ones. The challenge is not only technical reconstruction but also sequencing, because a rushed recovery can reintroduce the attacker’s foothold. That is why identity recovery plans must define trust validation steps before normal operations resume.
Practical implication: Build recovery runbooks that separate restoration from re-authorisation and require explicit trust validation before privileged access returns.
Business resilience depends on identity governance decisions
The article frames cyber crisis management as a leadership problem because the hardest calls involve prioritising services, communicating externally, and deciding who can act when normal controls are impaired. That is an identity governance problem as much as an incident response problem, because delegated authority and privileged access determine who can make those decisions safely. The failure mode is not just outage, but uncertainty about whether the people acting in recovery are still operating inside trusted boundaries.
Practical implication: Define emergency delegation, privileged recovery roles, and communication authority in advance so crisis decisions do not depend on ad hoc access grants.
Threat narrative
Attacker objective: The attacker objective is to create maximum blast radius by breaking the trust foundation that the business depends on for recovery and continuity.
- Entry occurs through the broader cyberattack conditions the article describes, where adversaries target the systems that underpin trust and access rather than a single isolated endpoint.
- Credential and identity abuse becomes the high-value path because identity systems concentrate the permissions that let attackers widen impact across the environment.
- Escalation follows when compromised identity state undermines recovery confidence, making it difficult to distinguish legitimate administration from attacker activity.
- Impact is business-wide disruption, because the organisation cannot confidently restore core services or maintain trusted operations until identity foundations are repaired.
Breaches seen in the wild
- Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
- CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Identity recovery is now a resilience control, not a cleanup activity. The article is right to place identity at the centre of cyber resilience because the directory and access layer define who can safely act during recovery. When trust in that layer is lost, the business cannot separate legitimate restoration from adversary persistence. Practitioners should therefore treat identity restoration as a prerequisite for resuming operations, not a post-incident afterthought.
Standing trust assumptions are the real resilience weakness. Many resilience programmes assume that if systems come back online, operations will naturally stabilise. That assumption fails when the identity layer itself is compromised, because restored services can remain insecure if privilege, delegation, or group membership is not revalidated. The governance lesson is that resilience depends on re-establishing trust boundaries, not just restarting infrastructure.
Cyber resilience exposes the difference between technical recovery and business recovery. The article correctly frames the hardest decisions as business decisions because recovery sequencing, communication, and authority all affect whether the organisation can function. This is where identity governance intersects operational resilience: if emergency access and delegated authority are undefined, the response team may restore systems but still fail to restore control. Practitioners need crisis authority models that can survive partial identity failure.
Blast-radius control is the decisive identity-security metric in a crisis. The article's emphasis on attackers using identity systems for maximum impact points to a broader governance truth. Organisations do not get resilience credit for merely detecting compromise quickly if they cannot limit how far it spreads or how long trust remains uncertain. The practical conclusion is to design identity controls around containment, recovery confidence, and service prioritisation.
What this signals
Identity recovery belongs in the same planning cycle as continuity and crisis communications. If authentication services or directory trust fail, the organisation is no longer just recovering technology. It is recovering decision rights, service access, and the ability to distinguish trusted administrators from compromised ones.
Resilience programmes should be measured by restore confidence, not by outage duration alone. A shortened recovery time is not enough if the identity layer still cannot prove authority or contain privilege drift. The stronger metric is whether the business can resume with validated access boundaries intact.
For practitioners
- Define identity recovery as a continuity requirement Classify directories, authentication services, and delegated authority paths as recovery-critical assets with explicit restore targets and trust-validation steps.
- Document emergency delegation before a crisis Pre-approve who can authorise privileged actions, service prioritisation, and external communication when normal identity controls are degraded.
- Test restoration of trust, not just restoration of systems Run exercises that verify clean admin access, authoritative identity state, and safe re-entry of privileged users after a compromise.
- Map business services to identity dependencies Identify which services fail first when authentication, directory services, or privileged access management are unavailable, then rehearse recovery by service tier.
Key takeaways
- Cyber resilience fails when organisations treat identity as a supporting control rather than a recovery-critical dependency.
- The article's central warning is that compromised identity foundations can enlarge the blast radius of any incident and delay safe restoration.
- Practitioners should plan for trusted identity restoration, emergency authority, and service prioritisation before a crisis begins.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | RC.RP-01 — Recovery Plan Execution | The article is fundamentally about restoring services and trust after a cyber incident. |
| GV.RR-03 — Roles, Responsibilities, and Authorities | The article stresses delegated authority and crisis decision-making during cyber events. | |
| PR.AA-05 — Access Permissions, Entitlements and Authorizations | Identity recovery and privileged access are central to the article's resilience argument. | |
| Recommendation — Use RC.RP-01 to validate that recovery plans restore both service availability and trusted identity state. Define crisis roles and authorities so privileged decisions remain governed when normal controls are impaired. Review access permissions so recovery actions can be re-authorised only for trusted identities. | ||
| NIST SP 800-53 Rev 5 | CP-2 — Contingency Plan | The article frames cyber resilience as continuity planning under disruptive conditions. |
| IA-5 — Authenticator Management | Recovery confidence depends on authenticators and trust material being controlled during incident response. | |
| Recommendation — Align contingency planning with identity restoration so core services can resume safely after compromise. Control authenticators so recovery does not reintroduce compromised credentials or stale trust material. | ||
| MITRE ATT&CK | TA0006;TA0040 — Credential Access; Impact | The article highlights attackers using identity systems to maximise disruption and business impact. |
| Recommendation — Map identity-centric incidents to credential access and impact so you prioritise containment around the blast radius. | ||
Key terms
- Cyber Resilience: Cyber resilience is the ability to continue operating, recover, and make safe decisions during and after a cyber incident. It goes beyond backup availability by combining visibility, prioritisation, and restoration discipline so the organisation can restore what matters without amplifying harm.
- Identity Recovery: Identity recovery is the process of restoring identity systems to a trusted state after compromise. It includes containment, forensic validation, removal of persistence, and confirmation that access controls and directory relationships no longer expose the environment.
- Blast Radius: The potential scope of damage if a specific credential or identity is compromised. Identities with broad permissions have a larger blast radius and represent a higher priority for least-privilege enforcement and security controls.
- Delegated Authority Model: A delegated authority model defines who is allowed to approve, review, or execute control-related decisions across the enterprise. It helps ensure requests reach the correct responsible party, especially when control owners, managers, and process owners sit in different teams, regions, or systems.
Deepen your knowledge
NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, identity lifecycle, and secrets management. It is designed for practitioners who need to connect identity controls to broader security and resilience programmes.
Published by the NHIMG editorial team on July 24, 2026.
Updated on October 13, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org