Identity attacks, rogue endpoints and vendors speed ransomware attacks

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Barracuda's report: Identity attacks, rogue endpoints and third-party exposure combined to accelerate ransomware outcomes across the 2025 incident set.

Why it matters: Security and identity teams need to treat endpoint trust, privilege escalation and third-party access as one attack path, not separate programmes.

By the numbers:

• 100% of security incidents involved at least one unprotected or rogue endpoint.
• 66% of incidents involved the supply chain or a third party.
• 96% of incidents involving lateral movement ended with the release of ransomware.

Context

The security problem here is speed: attackers are moving from initial access to encryption faster than many governance and response processes can intervene. That compression matters because identity, endpoint and third-party trust controls are often managed in separate programmes even though the attack path links them together.

Barracuda's dataset points to a familiar weakness pattern. Once a user account, remote endpoint or supplier connection is exposed, attackers can pivot into privilege abuse and ransomware before conventional review cycles catch up.

Key questions

Q: How do attackers turn a user login into ransomware?

A: Attackers usually turn a user login into ransomware by stealing credentials, hijacking a session, or abusing a valid account to gain initial access, then escalating privileges and disabling defences before deploying malicious encryption tools. Common failure modes include reused passwords, phishing, missing MFA, and excessive admin rights that let the attacker move from one logged-in user to broader domain control.

Q: Why do unprotected endpoints increase identity risk?

A: Unprotected endpoints increase identity risk because they are easier to compromise, letting attackers steal tokens, browser sessions, certificates, or cached credentials from a laptop or server before controls like MFA or conditional access can help. Weak device posture also makes it harder to trust the endpoint’s requests, so account takeover and lateral movement become much easier.

Q: What breaks when an autonomous AI agent can chain credentials, privilege escalation, and lateral movement on its own?

A: The break point is the assumption that access remains stable long enough for human review or remediation. An autonomous agent can move from foothold to escalation before those controls trigger, so identity governance has to stop relying on retrospective certification and shift toward runtime enforcement and session containment.

Q: How should teams detect risky third-party access before it is abused?

A: Look for external identities with broad scopes, long-lived secrets, and permissions that no longer match current contracts or operational need. Those are the strongest indicators that trust has outgrown governance. Monitoring should focus on issued credentials, last-used dates, and whether the integration still has a valid business owner.

Technical breakdown

Why rogue endpoints matter in identity-driven intrusions

A rogue or unprotected endpoint is not just an unmanaged device. It is a trusted place where credentials, sessions and remote access paths can be abused without the visibility that normally comes from endpoint control, device posture or managed enrollment. In identity-driven intrusions, the endpoint often becomes the bridge between valid access and unauthorized action. If the device is outside policy, the organisation loses one of the main signals that normally distinguishes legitimate use from suspicious activity. See the Endpoint Security Guide.

Practical implication: Tie access decisions to device trust and posture so that unmanaged endpoints do not inherit the same access rights as governed devices.

How privilege escalation turns limited access into ransomware

Privilege escalation is the point at which an attacker converts a low-value foothold into administrative control. That shift matters because once attackers hold elevated rights, they can disable defenses, expand across systems and prepare encryption or exfiltration at scale. In identity terms, the problem is not only stolen access but the absence of effective privilege boundaries after initial compromise. The report's findings fit a pattern where escalation is the decisive step that turns a single compromise into a wider security event.

Practical implication: Treat privilege escalation as the moment to isolate and contain, not as a later forensic detail.

Why third-party access shortens the attack path

Third-party access expands the number of identities, endpoints and trust relationships that can be used to enter an environment. When supplier accounts or connected services are not governed with the same rigor as internal access, attackers can exploit the weaker edge and move into core systems quickly. The issue is not vendor presence alone but the uneven control surface created by external trust. In practice, third-party connectivity can collapse segmentation if access scope, monitoring and offboarding are inconsistent. See the MDR Guide.

Practical implication: Review supplier access as a high-risk identity path and align it to the same authorization and monitoring standards as internal access.

Threat narrative

Attacker objective: The attacker objective is to reach administrative control quickly enough to disable defenses and encrypt systems before response can stop the attack.

1. Entry through unusual or unexpected logins to user accounts that did not match normal device, location or time patterns.
2. Escalation when attackers used privilege escalation to move from limited access to administrative control.
3. Impact when defenders were disabled, lateral movement expanded and ransomware was released, often within hours.

Breaches seen in the wild

• Salt Typhoon telecom intrusions 2025: Salt Typhoon breached US telecoms mainly with stolen logins, then harvested SNMP strings and TACACS/RADIUS keys to spread and persist for years.
• Storm-2949 Azure Breach: Storm-2949 social engineering attack turns one cloud identity compromise into full Azure tenant breach.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity compromise is now an endpoint problem as much as an access problem. Barracuda's findings show that the first durable weakness is often the device, not the account itself. Once an attacker lands on an unprotected or rogue endpoint, identity controls lose context and privilege abuse becomes far easier. Practitioners should stop treating endpoint hygiene and identity governance as separate workstreams.

Privilege escalation is the control failure that converts visibility gaps into ransomware outcomes. The report links limited access to administrative control, then to lateral movement and encryption. That sequence shows why entitlement boundaries matter after the first login, not just at provisioning time. The implication is that privilege governance must be measured by how much damage a compromised identity can still do.

Third-party access creates the shortest credible path from compromise to enterprise impact. Barracuda's data shows that supply chain or external-party involvement is a major feature of incidents. That does not make every supplier risky in the same way, but it does mean external trust expands the blast radius when access is weakly scoped or poorly monitored. Organizations need to evaluate third-party identity paths as attack routes, not just as contractual relationships.

Identity review cadences are too slow for attacks measured in hours. The report's fastest ransomware attack reached encryption in 3 hours, which compresses the time available for detection, escalation approval and manual response. That timing matters because governance models built around periodic review assume there is still something to review. Practitioners should treat speed as a design constraint, not an operational surprise.

From our research library:

• 74% of organizations report identity-related breaches, and privileged access is a leading cause of lateral movement.
• Read next: Top 10 NHI Issues

What this signals

Identity blast radius now depends on endpoint trust. Organisations that let static or unmanaged credentials and unmanaged devices accumulate are giving attackers more than a foothold, they are extending the time window in which escalation can succeed. According to the 2026 Infrastructure Identity Survey, organisations that rely heavily on static credentials reported a 20-percentage-point increase in security incidents compared with those with low reliance.

Fast ransomware compresses governance into runtime decisions. A 3-hour path from breach to encryption leaves little value in periodic certification alone, because the control arrives after the attack has already matured. Identity, endpoint and third-party governance now need to converge around live containment signals rather than separate review cycles.

For practitioners

• Restrict trust in unmanaged endpoints Block high-risk access from devices that are not enrolled, posture-checked or continuously monitored, especially for remote logins and privileged sessions.
• Contain privilege escalation paths Reduce the blast radius of any initial access by limiting standing privilege, separating admin functions and alerting on rapid permission changes.
• Reassess third-party identity paths Apply stronger approval, scoping and monitoring to supplier accounts, integrations and remote support paths that can reach production systems.
• Test response against hour-scale ransomware Validate whether detection, containment and executive escalation can happen before an attacker reaches encryption, not after the incident has spread.

Key takeaways

• The report ties ransomware outcomes to a chain that starts with identity compromise, moves through privilege escalation and ends in rapid encryption.
• The evidence points to a broad exposure pattern: every incident involved at least one rogue or unprotected endpoint, and third-party involvement was common.
• Practitioners need to collapse endpoint, identity and supplier controls into one containment model because the attack path no longer respects programme boundaries.

Related NHI Mgmt Group resources: Top 10 NHI Issues · Ultimate Guide to NHIs: Key Challenges and Risks · Lateral Movement Guide · T1021 Remote Services

Key terms

• Ransomware: Ransomware is malicious software or an attack campaign that blocks access to systems or data and then pressures the victim for payment. In modern incidents, encryption is often combined with theft, disruption, and coercion so the attacker can increase leverage before recovery is possible.
• Rogue Endpoint: A rogue endpoint is an unmanaged or unauthorised device that connects to an organisation’s network, cloud environment, or identity services. Because it is outside normal control, it may lack enrolment, hardening, monitoring, and patching, which makes it a common source of credential theft, malware entry, and unauthorised access.
• Unprotected Endpoint: An unprotected endpoint is a device that lacks adequate security controls such as patching, disk encryption, endpoint protection, screen lock, or device compliance checks. In identity and access terms, it is a device that cannot be trusted for access decisions because it may expose passwords, tokens, certificates, and active sessions to theft or misuse.
• Privilege Escalation: An attack technique where a compromised identity, often an NHI with initially limited permissions, exploits vulnerabilities or misconfigurations to gain elevated access rights, typically leading to broader compromise.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.