Identity risk reports show where current controls are failing

At a glance

What this is: This is an analysis of several identity security reports that all point to the same conclusion: current controls are not keeping pace with identity risk across users, NHIs and breached environments.

Why it matters: It matters because IAM, PAM and NHI teams need to treat identity verification, MFA quality, privilege scope and identity-related breach trends as one control problem rather than separate workstreams.

Context

Identity risk is the failure of current controls to prove, constrain and monitor who or what is accessing systems. In this article, Axiad argues that the problem is no longer limited to human sign-in friction. It now spans user verification, MFA quality, non-human identity privilege and third-party exposure.

The article pulls together a set of industry reports to show that identity has become a core breach-control issue. The practical question for identity programmes is no longer whether access exists, but whether the control model can still distinguish legitimate identity from misuse, reuse or excessive privilege.

Key questions

Q: What breaks when identity verification is weak across users and NHIs?

A: Weak verification turns identity into an entry point rather than a trust boundary. Attackers can exploit reused credentials, phishing-resistant gaps or excessive NHI access to reach systems that should have been gated. The result is higher account takeover risk, broader access paths and more opportunity for lateral movement once the initial identity control fails.

Q: Why do excessive NHI privileges increase breach impact?

A: Because attackers rarely need root access if an NHI already has more permission than its workload requires. Excessive privilege turns a single compromised key, token, or service account into lateral movement, data access, or infrastructure control. The risk grows further when those identities are externally exposed or not rotated on schedule.

Q: How do teams know if identity security controls are actually working?

A: Identity security controls are working when teams can show a current view of high-risk entitlements, detect privilege drift quickly, and remove access before exposure spreads. A useful sign is reduced time between entitlement change and policy review. Another is fewer unresolved conflicts between approved access and actual production permissions.

Q: Should organisations treat MFA adoption as enough for identity security?

A: No. MFA helps, but the article shows that not all MFA is equally resistant to phishing or reuse. Organisations should distinguish between generic MFA coverage and methods that actually stop identity abuse, especially for privileged access, external users and high-value business systems.

Technical breakdown

Why identity verification fails as a control boundary

Identity verification is the point at which a system decides whether the presenting subject is who it claims to be. In practice, that boundary weakens when verification relies on factors that can be phished, reused or socially engineered. The article’s core message is that organisations often count authentication as a solved problem when the underlying proof quality is still uneven. That matters because weak verification does not just create login noise. It expands the reachable attack surface for account takeover, credential abuse and downstream access to sensitive systems.

Practical implication: treat verification strength as a control attribute, not a binary on-off setting.

Why overprivileged NHIs turn identity into a lateral movement problem

Non-human identities are service accounts, tokens, keys and other machine credentials that act without human supervision. When those identities carry excessive privilege, the control failure is not just overreach. It is durable access that can be reused across systems, environments and third-party touchpoints. The article cites data showing NHIs are widely overprivileged and frequently exposed to third parties, which means the blast radius is often larger than the owner understands. In identity governance terms, this is a privilege scope problem combined with weak lifecycle discipline.

Practical implication: inventory NHI privilege scope and owner responsibility before you attempt broader policy redesign.

Why identity-related breaches keep outpacing traditional IAM assumptions

Traditional IAM assumes identity controls reduce risk when they are deployed, but the article shows the breach pattern is still growing. That points to a gap between control presence and control effectiveness. Multifactor authentication, access governance and user education all help, but the article’s report mix suggests they are frequently applied in ways that do not stop identity-driven abuse. The result is a programme that may improve hygiene while leaving attack paths intact. This is especially visible when identity controls are operationalised for convenience instead of enforced as security boundaries.

Practical implication: measure whether identity controls are actually blocking abuse, not merely improving process efficiency.

Threat narrative

Attacker objective: The attacker’s objective is to turn identity weakness into durable unauthorized access that can be reused for breach activity, data theft or lateral movement.

1. Initial access begins when an attacker or fraud actor abuses weak identity verification, reused credentials or phishing-resistant gaps in MFA coverage.
2. Credential access expands when stolen, reused or socially engineered identity material is accepted as legitimate across human and machine access paths.
3. Privilege escalation follows when excessive NHI permissions or poorly bounded access policies give the actor broader reach than intended.
4. Impact occurs through identity-related breaches, unauthorized system access, data theft or lateral movement across connected services.

Breaches seen in the wild

• Co-op cyber attack 2025: Attackers linked to Scattered Spider tricked their way into a Co-op employee account and stole personal data of all 6.5 million members.
• Scania insurance portal breach 2025: An attacker used an external user login, likely stolen by infostealer malware, to take insurance claim documents from a Scania portal.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity risk has become a control-failure category, not an awareness problem. The reports cited in this article converge on the same point: identity is now one of the most reliable paths into the enterprise. That means identity risk must be managed as a breach-control discipline spanning verification, privilege, lifecycle and monitoring. Organisations that still treat identity as an administrative layer will continue to undercount the attack surface.

Overprivileged non-human identities are the clearest sign that governance has not caught up with machine access. If 97% of NHIs have excessive privileges and 92% are exposed to third parties, the issue is not isolated misconfiguration. It is a structural failure to govern machine identity ownership, scoping and offboarding at enterprise scale. The practical conclusion is that NHI governance has to be treated as a core security control, not a back-office inventory task.

Phishing-resistant verification is now the dividing line between authentication and exposure. The article’s MFA data matters because not all MFA prevents identity compromise. Controls that can be replayed, phished or bypassed leave the organisation with a security theatre problem rather than an assurance control. The implication for practitioners is that authentication programmes need to distinguish between generic MFA adoption and methods that actually reduce identity attack success.

Identity programmes fail when they optimise for convenience before containment. The article’s discussion of complexity and productivity pressure shows how identity controls are often judged by user friction rather than breach resistance. That incentive structure produces broad deployment with shallow enforcement. Mature identity governance has to prove that controls reduce unauthorized access, not just streamline access administration.

Identity attack surface is expanding faster than most governance cycles. The reports referenced in the article point to growth in identities, breaches and operational complexity at the same time. That creates a moving target for IAM, IGA and PAM teams. The near-term priority is to shrink exposure windows and privilege breadth faster than identity sprawl expands them.

What this signals

Identity risk is now a programme design issue, not a single control gap. The reports cited in this article show that verification weakness, NHI privilege sprawl and identity-related breaches are reinforcing each other. Teams need to evaluate whether their current programme still assumes identity is a front-door problem when the real exposure now runs through service accounts, third parties and phishing-resistant gaps.

Privilege scope is becoming the most actionable identity metric. When machine identities are broadly overprivileged, the question is no longer how many identities exist but how far each one can move if compromised. That shifts the governance conversation toward entitlement minimisation, ownership and offboarding discipline across both human and non-human access.

For practitioners

• Tighten identity verification thresholds Separate basic login success from high-assurance identity proofing for sensitive applications, privileged roles and external access paths. Do not treat all MFA methods as equivalent in breach resistance.
• Rebaseline NHI privilege scopes Review service accounts, tokens and machine credentials for excessive permissions, third-party reach and unclear ownership. Remove broad entitlements that are not required for the current workload.
• Measure identity control effectiveness against breach outcomes Track whether identity controls are reducing account takeover, credential reuse and unauthorized access, not just increasing policy adoption or user compliance.
• Separate productivity metrics from security outcomes Assess identity programme success with breach resistance, privilege reduction and verification strength rather than only approval speed or user friction.
• Prioritise phishing-resistant authentication for high-risk access Where identity compromise would create immediate business impact, use authentication methods that materially reduce phishing and replay success instead of generic MFA coverage.

Key takeaways

• Identity risk is being driven by control weakness across verification, MFA quality and machine privilege rather than by any single failure.
• The article’s cited reports show the problem is already widespread, with identity-related breaches and excessive NHI permissions appearing across the landscape.
• Practitioners should reframe identity work as breach prevention and blast-radius reduction, not only access administration.

Key terms

• Identity verification: Identity verification is the process of confirming that a user, workload, or agent is the entity it claims to be before access is granted. In AI-heavy environments, that verification must include the requester, the system acting on its behalf, and the sensitivity of the action.
• Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
• Phishing-Resistant MFA: Phishing-resistant MFA uses authentication factors that cannot be easily replayed, intercepted, or socially engineered. In regulated environments, this usually means device-bound or cryptographic methods rather than push prompts or SMS codes, because the control must hold up under realistic attack conditions.
• Identity Attack Surface: Identity attack surface is the total set of accounts, tokens, login endpoints, trust paths, and supporting systems that can be probed for access. For password spraying, the risk grows with every externally reachable authentication path and every dormant or weakly protected identity.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.