Cybersecurity outcomes are stalling because containment is missing

At a glance

What this is: Illumio's analysis says cybersecurity progress is stalling because organisations keep measuring activity and compliance instead of containment and reduced blast radius.

Why it matters: That matters to IAM and security teams because control coverage alone does not stop spread when an attacker or compromised identity is already inside the environment.

Context

Cybersecurity is a control and governance problem as much as it is a detection problem. When organisations measure success by tool deployment, alert volume, or audit completion, they can mistake activity for reduction in exposure. That gap becomes more visible when incidents move quickly across networks, cloud environments, and identity paths that were assumed to be sufficiently protected.

For IAM, PAM, NHI, and broader security programmes, the intersection is simple: access and segmentation decisions shape how far an incident can travel after entry. If critical systems, service accounts, and delegated access paths remain broadly reachable, prevention can fail and recovery becomes more expensive. The article frames a common enterprise position as typical, not exceptional.

Key questions

Q: Where does cybersecurity fail when organisations keep adding controls but not containment?

A: It fails when control activity is mistaken for reduced exposure. Organisations can pass audits, deploy tools, and close alerts while still leaving broad east-west access, overprivileged identities, and weak segmentation in place. In that situation, a single foothold can still become a large incident because the environment was never designed to limit spread after entry.

Q: How should security teams govern privileged access in cloud and hybrid environments?

A: Teams should govern privileged access around runtime authorization, not just connectivity or login. That means scoping elevation to a specific task, setting an expiry, logging approvals, and revoking access automatically when work is complete. The goal is to reduce standing privilege and create evidence that can withstand incident review and audit.

Q: What are the signs that containment is failing in practice?

A: Containment is failing when teams cannot quickly isolate a host, revoke a risky path, or explain how far an identity can move laterally. If east-west visibility is weak and recovery depends on manual intervention, the environment is already too open.

Q: Should organisations prioritise prevention or containment first?

A: They should do both, but containment usually deserves priority in environments where some compromise is inevitable. Prevention reduces entry opportunities, yet containment determines whether an incident stays small or becomes expensive. If you can only improve one area quickly, reduce reachable assets and privilege scope first.

Technical breakdown

Why activity metrics hide exposure

Security programmes often track output metrics such as alerts closed, controls deployed, or frameworks completed because they are easy to count. The problem is that these metrics do not necessarily reflect whether the environment became harder to move through. A mature-looking dashboard can coexist with flat breach impact if the underlying architecture still allows broad reach once an attacker gains a foothold. In practice, this is a measurement problem: the organisation is observing work performed, not the reduction of attack paths or blast radius.

Practical implication: replace activity measures with control outcomes tied to lateral movement, segmentation, and access scope.

Containment as a runtime security control

Containment is the set of technical and governance decisions that limit what an attacker, compromised user, or compromised workload can reach after initial access. It includes segmentation, least-privilege access, isolation of critical assets, and restricting communication paths between workloads and identities. Unlike pure prevention, containment assumes some controls will fail and is designed to keep the failure local. In identity-heavy environments, this matters because standing access, overbroad service permissions, and weak trust boundaries turn a single compromise into an enterprise event.

Practical implication: design critical paths so compromise of one identity or workload does not automatically expose the rest of the environment.

Why identity scope determines blast radius

Identity is the practical control plane for blast radius. Human users, service accounts, tokens, and delegated access paths all define what an attacker can do once credentials are abused or a session is hijacked. If those identities are overprivileged or poorly isolated, the attacker does not need many additional techniques to move laterally. This is where IAM and PAM connect directly to resilience: access design is not just about who can log in, but about how far an intrusion can travel before it is detected or stopped.

Practical implication: review privilege boundaries as containment controls, not only as authorization controls.

Threat narrative

Attacker objective: The attacker seeks to turn a single compromise into broad operational impact by spreading across trusted environments.

1. Entry occurs through an initial foothold that may not be fully preventable, especially in large distributed environments with many trust paths.
2. Escalation happens when broad access, weak segmentation, or overprivileged identities let the attacker move beyond the first compromised system.
3. Impact follows when the intrusion spreads across assets that were assumed to be protected, increasing recovery cost and operational disruption.

Breaches seen in the wild

• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
• CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Containment is now the decisive control variable: organisations can keep adding preventive tooling without changing breach outcomes if the post-entry environment remains too open. The article is right to shift the conversation from “did we stop the attack?” to “how far could it go?” That is a governance change as much as a technical one, and it puts segmentation, identity scope, and runtime isolation at the centre of the security model.

Metric debt is obscuring real resilience: security programmes still overvalue counts that describe effort, not exposure reduction. Dashboard-friendly measures can satisfy leadership while leaving lateral movement paths untouched, which is why breaches can still become large and costly even in well-instrumented environments. Practitioners should treat blast radius reduction as a first-class outcome, not a side effect of detection.

Identity governance is part of containment, not separate from it: service accounts, tokens, and delegated access define the practical spread of compromise across cloud and application environments. When those identities are standing, broad, or shared, containment becomes harder to achieve even if the perimeter is strong. The named concept here is blast-radius control: the discipline of limiting what any compromised identity or workload can reach.

AI will widen the gap between access and impact unless runtime limits improve: the article’s AI point matters because faster attacker execution compresses the time defenders have to react. That makes post-entry controls more important, not less, and it raises the value of architectures that assume compromise while still constraining reach. For practitioners, the lesson is to build for interruption of spread, not just for detection of presence.

What this signals

Blast-radius control is becoming the more useful resilience lens because it measures whether a compromised identity or workload can spread, not whether every attack was blocked. For practitioners, that means segmentation, privilege boundaries, and runtime isolation belong in the same conversation as detection.

Security teams should expect leadership to ask for outcome measures that map to operational loss, not activity volume. The right question is no longer how many alerts were handled, but how much of the environment remained unreachable when a control failed.

For practitioners

• Measure blast radius directly Add containment-oriented KPIs such as reachable critical assets, allowed east-west paths, and identities with cross-zone access. Stop treating alert counts and audit completion as proxies for reduced exposure.
• Segment critical systems by consequence Group the assets that would create the largest operational or regulatory impact if reached, then isolate them with tighter communication rules and stricter identity boundaries.
• Reduce standing identity reach Review human and non-human identities for unnecessary reach into adjacent systems, especially service accounts, tokens, and delegated permissions that could expand an initial foothold.
• Test containment under compromise Run scenarios that assume initial access already exists and validate whether the environment still prevents lateral movement, privilege spread, and broad data access.

Key takeaways

• Cybersecurity programmes can look mature while still allowing an intrusion to spread quickly across trusted environments.
• The article’s central warning is that activity, compliance, and tool count do not prove containment.
• Practitioners should treat reduced reach, narrower privilege, and smaller blast radius as core security outcomes.

Key terms

• Blast Radius: The potential scope of damage if a specific credential or identity is compromised. Identities with broad permissions have a larger blast radius and represent a higher priority for least-privilege enforcement and security controls.
• Containment: The phase of incident response that stops an incident from spreading while preserving the evidence needed to investigate it. In cloud environments, containment often starts with identity revocation, isolation of workloads, and protection of logs before any system is terminated or cleaned up.
• Lateral Movement: A post-compromise technique where an attacker uses a compromised NHI to move through a network, accessing additional systems and escalating impact without triggering detection.
• Overprivileged Identity: An overprivileged identity has more access than its workload or service actually needs. In NHI environments, this often happens through default cloud permissions, role accumulation, or poor review discipline. The practical risk is a larger blast radius if the identity is compromised or misused.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. It is suitable for security practitioners who need to connect identity controls to containment, resilience, and access governance.