Identity based attacks expose the limits of legacy IAM controls

At a glance

What this is: Zero Networks says identity-based attacks are increasingly driven by valid credentials, exposed secrets, and machine identities that let attackers blend into normal access patterns.

Why it matters: IAM and PAM teams need to treat identity as the perimeter because valid logins, standing privilege, and lateral movement controls determine whether stolen access becomes a breach.

Context

Identity-based attacks are attacks that abuse legitimate identity paths rather than forcing their way through a perimeter. The article argues that modern adversaries are using valid credentials, exposed secrets, and machine identities to gain access that looks normal to legacy controls.

That matters for identity governance because many programmes still assume access can be reviewed, detected, or remediated after issuance. When credentials are stolen, reused, or harvested through AiTM and infostealers, the control problem shifts from authentication alone to privilege scope, segmentation, and lifecycle enforcement.

The vendor frames this as a broad change in how identity security should be designed across users, service accounts, devices, and applications. That is a typical enterprise pattern, not an edge case.

Key questions

Q: What breaks when attackers steal a valid identity credential?

A: A valid credential collapses the difference between an external attacker and a trusted user or workload. Once the credential is accepted, the attacker can blend into normal authentication flows, move into connected systems, and often bypass controls that only protect the front door. The real failure is not just compromise, but the ability to reuse trust across multiple services.

Q: Why do valid credentials make lateral movement so hard to detect?

A: Valid credentials let attackers appear to be normal users or administrators, so the traffic often blends into routine operations. Detection improves when teams combine session baselining, access policy, and behavioral analysis, rather than relying only on malware signatures or perimeter alerts. Identity context is what turns activity into a signal.

Q: What are the signs that machine identities are being overprivileged?

A: Common signs include service accounts with broad network reach, unused privileges that remain enabled, credentials with no clear owner, and identities that persist long after the system or project changed. If the account can access more than its workload needs, it is already a candidate for abuse.

Q: How should organisations reduce the risk of identity-based attacks?

A: Organisations should combine MFA, rate limiting, password hygiene, and continuous privilege review with strong identity lifecycle controls. The goal is to make stolen credentials less useful and to remove access quickly when it is no longer needed. That approach reduces both initial compromise and the chance that an attacker can expand access after entry.

Technical breakdown

Why valid credentials defeat perimeter-era identity controls

Identity-based attacks succeed because many controls still treat successful authentication as proof of trust. In practice, a stolen password, session token, service ticket, or exposed secret can be enough to look legitimate to downstream systems. That is why phishing, credential stuffing, AiTM interception, and pass-the-ticket abuse work so well: the attacker does not need to break the identity system, only inherit its trust. Once inside, the same identity can be used to pivot between resources if segmentation is weak and privilege is broader than the task requires.

Practical implication: shift from login success as the control point to limiting what the identity can reach after authentication.

How machine identities expand the attack surface

Machine identities include service accounts, API tokens, workload credentials, and other non-human credentials that can authenticate without a person present. The article points out that these identities are often overprivileged, weakly monitored, and easy to miss when traditional enforcement is built around users. That creates a structural gap: automated systems can hold access long after a human owner has changed roles, a project has ended, or a repository has leaked credentials. The result is a larger, less visible attack surface than most IAM inventories reflect.

Practical implication: inventory non-human credentials separately from human accounts and govern their scope, ownership, and revocation as first-class access paths.

Why static identity policy cannot keep up with attacker tempo

The article’s best-practice section shows why static controls struggle when attackers move quickly and quietly. If policies are not adapted as network conditions, logon patterns, and asset relationships change, stolen credentials remain useful long after their initial exposure. Identity segmentation and microsegmentation work here by constraining which identities can reach which assets and by shrinking the value of any one credential. This is a shift from reactive detection to enforced blast-radius control, which is especially important when adversaries use AI, access brokers, or infostealers to accelerate abuse.

Practical implication: design access boundaries that make stolen credentials fail by default, rather than relying on detection after misuse begins.

Threat narrative

Attacker objective: The attacker’s objective is to convert trusted identity access into quiet lateral movement and privileged reach inside the environment.

1. Entry occurs through valid credentials, phishing, credential stuffing, AiTM interception, exposed secrets, or access purchased from brokers rather than through noisy exploitation.
2. Credential harvesting and reuse let attackers authenticate as legitimate users, service accounts, or ticket holders without immediately triggering classic intrusion alerts.
3. Escalation follows when overprivileged identities, weak segmentation, or reusable machine credentials let the attacker move laterally and expand access.
4. Impact is achieved by preserving stealth while reaching sensitive systems, cloud storage, or downstream services with trusted identity paths.

Breaches seen in the wild

• SonicWall SSL VPN account compromises 2025: Attackers used valid credentials to log in to more than 100 SonicWall SSL VPN accounts across 16 environments in October 2025.
• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Legacy IAM is being bypassed at the trust boundary, not defeated at the authentication screen. The article shows that valid credentials, session theft, and exposed secrets let attackers appear legitimate to systems that still equate successful login with trustworthy access. That makes identity-based attacks a governance problem, not just an authentication problem. Practitioners should read this as a signal that trust must be enforced after login, not assumed at login.

Machine identity sprawl has become an exposure multiplier. Service accounts, tokens, and other non-human credentials are often overprivileged, under-owned, and poorly visible to human-centric IAM programmes. Once they are treated as disposable implementation details instead of governed identities, they create durable access paths that attackers can reuse. The practical conclusion is that machine identity governance must be measured with the same seriousness as human access governance.

Identity segmentation is becoming the real control plane for modern access governance. The article’s logic is that broad trust zones let stolen credentials remain useful even after detection tooling fires. Segmentation, least privilege, and logon-type restriction turn identity from an open passage into a constrained route. For practitioners, the shift is from asking whether an identity authenticated to asking what that identity can still reach after authentication.

Identity-based attacks expose a governance assumption that was designed for stable, reviewable access. Access review processes were built for identities that persist long enough to be inspected and certified. That assumption fails when attackers obtain credentials, use them immediately, and move laterally before the review cycle even begins. The implication is that lifecycle governance must move closer to issuance, entitlement boundaries, and runtime reachability.

Identity blast radius, not login volume, is the field’s most useful concept here. The article repeatedly shows that the damage comes from what a credential can reach once it is accepted, not from the fact that login occurred. This is why practitioners should measure identity security by reachable assets, privilege scope, and segmentation depth. If blast radius is wide, breach probability becomes almost secondary to breach consequence.

What this signals

Identity-based attacks are forcing identity programmes to become reachability programmes. The question is no longer whether an account can authenticate, but whether that identity can reach anything meaningful after authentication. That shift pushes IAM, PAM, and segmentation teams into the same design conversation.

Machine identity governance now sits on the critical path for breach prevention. Service accounts and tokens are no longer background plumbing because they can carry the same blast radius as a human account, often with less scrutiny. Teams that cannot inventory or bound those identities are leaving a large part of their environment outside practical governance.

Zero trust only becomes useful when it is enforced at the identity layer. Without segmentation that constrains logon types, protocols, and reachable assets, zero trust remains a slogan rather than a control model. The programme-level task is to translate policy into identity-scoped enforcement.

For practitioners

• Tighten access around valid credentials Treat successful authentication as the start of control, not the end of it. Require downstream authorization boundaries that limit what a credential can do after login, especially where attackers commonly reuse stolen identities.
• Inventory machine identities separately Build a separate governance view for service accounts, API tokens, and other non-human credentials. Track ownership, privilege scope, and revocation status so that abandoned or overprivileged machine identities are not left standing.
• Enforce segmentation at the identity layer Constrain which identities can reach which assets, logon types, and protocols so stolen credentials lose value outside their approved route. This is especially important for privileged access and east-west movement.
• Reduce the lifetime of exposed secrets Prioritise rapid discovery and revocation for secrets that appear in repositories, build systems, or vendor paths. The article shows that long remediation windows leave attackers plenty of time to convert exposure into access.
• Rework access reviews for fast-moving threats Move beyond periodic attestation for identities that may be abused within minutes or hours. Focus reviews on high-risk entitlements, third-party paths, and any account that can become a lateral movement bridge.

Key takeaways

• Identity-based attacks succeed when valid credentials are treated as trustworthy by default rather than as a reason to narrow access.
• The article points to valid credentials, exposed secrets, machine identities, and third-party access as the main conditions that let attackers blend in.
• Practitioners need to focus on segmentation, privilege scope, and machine identity governance so stolen access does not become lateral movement.

Key terms

• Identity-based threat: An identity-based threat is an attack that abuses legitimate credentials, sessions, or account permissions rather than breaking into the network first. It succeeds by looking like normal access while the attacker steals data, moves laterally, or escalates privilege.
• Machine Identity: The digital identity of a machine, device, or workload, such as a server, container, or VM, used to authenticate it within a network. Sometimes used interchangeably with NHI, though NHI is the broader category.
• Identity Segmentation: The practice of separating identities by workload, environment, and risk so one credential cannot easily move across unrelated systems. For machine identities, segmentation is a blast-radius control as much as a least-privilege measure, because shared dependencies can turn a single compromise into a wider operational event.
• Credential Abuse: Credential abuse is the use of valid secrets or accounts by an unauthorised party or for unauthorised purposes. In practice, it often looks like normal authentication unless teams correlate context, privilege, and behaviour. It is one of the most persistent ways identity failures become breaches.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.