Identity is the new perimeter in China-linked utility attacks

At a glance

What this is: This is an identity-security analysis arguing that credentials and access paths have become the decisive perimeter in attacks against small utilities.

Why it matters: It matters because IAM, PAM, and NHI programmes have to protect the access layer that attackers now target directly, not just the network boundary.

👉 Read Ory's analysis of why identity is the only perimeter left in utility attacks

Context

Identity is the control plane that determines whether an attacker can move from external access to operational impact. In campaigns that target small utilities, stolen credentials matter more than perimeter hardening because valid identity access can bypass many network-based assumptions.

For IAM and NHI practitioners, the question is not whether the firewall is configured correctly. The real issue is whether authentication strength, session controls, privileged access, and service-account governance are aligned to a zero-trust model that treats identity as the boundary.

The article frames a broader governance problem: organisations still invest heavily in perimeter thinking while adversaries increasingly exploit login paths, delegated access, and weak identity lifecycle controls. That is typical of environments where identity programmes have not become the primary security architecture.

Key questions

Q: How should security teams respond when credentials are exposed at massive scale?

A: Start with session invalidation, then rotate or revoke the affected secrets, tokens, and passwords. After that, map the exposed identities to privileged access paths, service accounts, and third-party integrations. The key is to treat exposed credentials as active until proven otherwise, especially when cookies or persistent sessions may still work.

Q: Why do stolen credentials defeat traditional perimeter controls so effectively?

A: Perimeter controls are designed to stop unauthorised traffic, not authenticated traffic from a valid identity. If the credential is accepted, the session often inherits trust, which is why identity assurance and privilege boundaries have to carry more of the security burden.

Q: What breaks when third-party access is not included in identity governance?

A: Auditability breaks first, followed by containment. Supplier accounts can remain active across multiple systems without clear ownership, which makes it difficult to prove who authorised access, whether it was still needed, and whether privileged activity was monitored throughout the relationship.

Q: How can organisations tell whether identity has really become the perimeter?

A: Look at where the decisive trust decision happens. If authentication, session policy, and authorisation context are all enforced before a user or workload can reach critical systems, identity is the perimeter. If network location still carries most of the trust, it is not.

Technical breakdown

Why identity becomes the perimeter

When adversaries obtain valid credentials, they no longer need to break the network boundary in the conventional sense. Access is then mediated by authentication, session state, and authorisation policy, which means the security outcome depends on identity assurance and privilege boundaries rather than IP reputation or perimeter filters. In practical terms, zero trust only works when identity controls are the first control plane, not a backstop after network defenses fail.

Practical implication: move the primary trust decision to identity assurance, session control, and least privilege enforcement.

How stolen credentials bypass perimeter defences

A firewall can block unsolicited traffic, but it cannot distinguish a legitimate login from a malicious one when the attacker already holds valid credentials. That is why credential theft remains such an effective entry point: it converts an external actor into an apparently authorised user or workload. Once inside, the attacker inherits whatever the identity was allowed to do, including access to SaaS, remote administration paths, and operational systems.

Practical implication: treat credential compromise as a control failure that requires stronger authentication, shorter sessions, and tighter entitlement scope.

Why small utilities are a high-value identity target

Small utilities often combine limited security staffing with operational environments that depend on stable access, shared admin patterns, and long-lived accounts. That creates a governance gap where identity controls may exist, but lifecycle discipline, privileged access review, and monitoring do not keep pace with operational reality. The result is not just access risk, but a pathway to outage, manipulation, or covert persistence.

Practical implication: review privileged accounts, service credentials, and remote access paths as operational assets, not just IT accounts.

NHI Mgmt Group analysis

Identity is now the perimeter because valid access has become the easiest route around traditional defences. Once attackers hold credentials, network controls lose much of their value because the traffic looks authorised. That shifts the centre of gravity from edge security to identity assurance, session governance, and privilege containment.

Standing access is the governance gap most exposed by this kind of attack. Identity programmes that tolerate persistent admin rights, long-lived sessions, and weak revocation processes create an environment where one compromised account can be operationally decisive. The practitioner takeaway is to treat every durable login path as a potential intrusion persistence mechanism.

Zero trust fails when identity is treated as an authentication event instead of a continuously governed control plane. The article reinforces that login is not the end of the security decision. The real control problem is whether the organisation can continually verify who or what is acting, what it can reach, and whether that access still makes sense in context.

Small utilities expose a broader market truth: identity resilience matters most where operational tolerance for disruption is lowest. These environments often cannot absorb long investigation windows, broad account resets, or weak access ownership. The implication is that IAM, PAM, and NHI governance must be built for operational continuity, not just compliance reporting.

From our research:

• The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
• Organisations maintain an average of 6 distinct secrets manager instances, creating fragmentation that undermines centralised control, according to The State of Secrets in AppSec.
• For a broader view of identity abuse patterns, review LLMjacking: How Attackers Hijack AI Using Compromised NHIs for evidence of how exposed credentials are weaponised rapidly.

What this signals

Identity has become the control plane that decides whether a perimeter still exists. As credential-based access becomes more valuable to attackers, organisations need to watch for programmes that still treat authentication as a one-time event rather than a continuously governed state. The practical shift is toward session-level policy, revocation speed, and privileged access containment across both human and machine identities.

With 27 days as the average time to remediate a leaked secret, the gap between compromise and containment is already large enough to matter operationally, and fragmentation across 6 secrets manager instances makes it harder to close. That is why identity programmes should align secrets governance with zero-trust access design and use the NIST SP 800-207 Zero Trust Architecture model as a control reference.

Identity perimeter collapse: this is the point at which login, session, and privilege controls replace the old network edge as the real boundary. Teams should pair that shift with a review of privileged access patterns and workload identity governance, using the OWASP NHI Top 10 as a practical lens.

For practitioners

• Re-centre the perimeter on identity assurance Map the controls that determine whether a session is trustworthy after authentication. Include MFA strength, conditional access, device posture, privileged session handling, and revocation paths for compromised accounts.
• Audit durable access paths for operational systems Identify persistent admin accounts, shared credentials, remote access accounts, and service identities that can reach critical utility workflows. Reduce standing privilege wherever a task does not require it continuously.
• Shorten the window between compromise and containment Test how quickly the organisation can disable access, invalidate sessions, and confirm propagation across connected systems. Recovery speed matters because valid credentials can move faster than manual review cycles.
• Apply zero trust to login paths and privilege, not slogans Verify that access decisions are contextual and continuously enforced across human and machine identities. If authentication alone grants broad reach, the identity perimeter is still too porous.

Key takeaways

• Stolen credentials can turn a legitimate login into the attacker’s fastest route past traditional perimeter defences.
• The governance problem is not only detection, but revocation speed, session control, and removal of standing privilege.
• Identity has to be treated as the perimeter for both human and machine access, or zero trust remains incomplete.

Key terms

• Identity Perimeter: The identity perimeter is the access boundary defined by who or what is requesting entry, not by where the request comes from. In zero trust, it is the point where authentication, authorization, and risk context decide whether a caller can proceed.
• Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.
• Session Governance: The practice of binding access to a specific task, time window, and execution context, then revoking it when the work is done. For non-human identities, session governance matters because tokens and delegated permissions often persist longer than the action they were created to support.
• Zero Trust: A security model that assumes no identity — human or non-human — should be trusted by default, even inside a network perimeter. Every access request must be verified, authorised, and continuously validated.

What's in the full article

Ory's full blog post covers the security and identity context this post intentionally leaves at the strategic level:

• The article’s specific China-linked utility attack context and why it matters for defenders.
• Ory's framing of identity as the operational perimeter and how that changes control priorities.
• The broader security argument behind zero-trust identity design in utility environments.

👉 Ory's full post expands on the credential-led attack path and the identity controls that matter most.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.