Identity security posture management is now central to ransomware defense

At a glance

What this is: This analysis argues that identity security posture management is the missing control layer for ransomware because attackers increasingly abuse valid accounts, service accounts, and other unmanaged identities.

Why it matters: It matters because IAM, PAM, and NHI teams need to reduce standing access and identity sprawl before ransomware operators use legitimate credentials to move laterally and disable recovery paths.

By the numbers:

• 83% of ransomware attacks compromised identity infrastructures, including credential theft, session hijacking, or misuse of legitimate accounts.
• The 2025 State of Ransomware report says attacks jumped 25% in a single year.
• IBM X-Force found that 30% of intrusions involved identity-based tactics, including lateral movement using valid accounts.

👉 Read Veza's analysis of how ISPM helps stop identity-driven ransomware

Context

Ransomware now behaves like an identity abuse campaign because attackers increasingly rely on legitimate access rather than noisy exploit chains. When orphaned accounts, over-permissioned service accounts, and unmanaged administrative tools remain in circulation, endpoint controls can miss the real path to impact. This is fundamentally an IAM and NHI governance problem, not just a malware containment problem.

Identity Security Posture Management, or ISPM, is the visibility and entitlement-control layer that exposes who can do what across human and non-human identities. For security teams, the issue is not whether ransomware exists, but whether standing access, shadow identities, and unused privilege are still available for abuse. That starting point is typical in hybrid environments, not exceptional.

Key questions

Q: How should security teams limit ransomware spread through identity controls?

A: Security teams should reduce standing privilege, segment admin roles, and require task-scoped elevation for high-risk actions. They should also separate backup access from production access so a compromised account cannot encrypt data and destroy recovery paths in the same session. The goal is to make one stolen credential useful only for a narrow set of actions.

Q: Why do service accounts with standing privilege make ransomware worse?

A: Standing privilege gives attackers persistent reach after initial compromise. If a service account can access more systems than it needs, ransomware operators can reuse that access for discovery, lateral movement, and destructive action before defenders can contain the session or revoke the entitlement.

Q: What breaks when identity visibility is missing during a ransomware attack?

A: Containment becomes guesswork. Security teams cannot tell which accounts are active, what they can reach, or which privileged paths they unlock, so they often default to broad shutdowns or partial revocation that leaves access open elsewhere. The result is longer outages, more manual work, and higher risk that attackers keep moving while teams investigate.

Q: Who is accountable when compromised credentials are used to trigger ransomware?

A: Accountability usually spans identity, infrastructure, and security operations because the failure chain includes authentication design, network trust boundaries, and detection gaps. Frameworks such as NIST CSF and Zero Trust Architecture place responsibility on governance that limits blast radius, not only on the team that owns the portal.

Technical breakdown

Why valid accounts defeat endpoint-first ransomware defence

Ransomware operators often do not need to “break in” once they obtain legitimate credentials. They can log in, enumerate accessible systems, and use admin utilities that look normal on the wire and on the endpoint. Tools such as PowerShell and PsExec blur legitimate administration and malicious movement, which makes detection harder when policy and identity context are missing. EDR can flag execution, but it does not explain whether the identity behind that execution should have had access in the first place.

Practical implication: teams need identity context tied to endpoint activity so valid-account abuse is visible before encryption or backup tampering starts.

How unmanaged NHIs expand ransomware blast radius

Service accounts, tokens, and orphaned machine identities often persist with broader access than human users because they are created for convenience and then forgotten. In ransomware cases, those identities become quiet pivot points for lateral movement, backup destruction, and privilege chaining. ISPM matters here because it maps entitlements to actual business use, exposing dormant accounts, hidden dependencies, and toxic combinations that attackers can abuse without triggering classic account compromise alerts.

Practical implication: inventory and continuously review non-human identities that can touch production, backups, or directory services.

Why identity graphing changes audit and remediation speed

An identity-to-data graph links identities, permissions, resources, and data access into one model, which is what spreadsheets cannot do at ransomware scale. That matters because the operational problem is usually not a lack of policy language, but an inability to answer who can reach what quickly enough to contain risk. Graph-based posture management shortens investigation, clarifies ownership, and makes over-privilege visible before it becomes an incident response dependency.

Practical implication: replace spreadsheet-driven access checks with a live entitlement model that supports rapid containment decisions.

Threat narrative

Attacker objective: The objective is to convert legitimate identity access into widespread operational disruption while avoiding early detection.

1. entry: Attackers gain access through compromised credentials, session hijacking, or misuse of legitimate accounts rather than relying only on malware delivery.
2. escalation: They use unmanaged identities, over-permissioned service accounts, and admin tooling to move laterally and expand privileges.
3. impact: They encrypt systems, disrupt operations, and target backup paths and recovery processes to increase pressure and ransom leverage.

Breaches seen in the wild

• Cisco DevHub NHI breach — IntelBroker exploited exposed Cisco credentials, API tokens and keys in DevHub.
• MITRE ATT&CK Enterprise Matrix — MITRE ATT&CK Enterprise — adversary tactics and techniques, threat detection, attack chain mapping, credential access, lateral movement, privilege escalation.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity ransomware is a governance failure before it is a malware event. The article’s core point is that attackers increasingly win by abusing legitimate access paths, not by relying on exotic exploits. That means the control failure sits in entitlement visibility, ownership, and lifecycle hygiene across both human and non-human identities. Practitioners should treat ransomware as proof that identity posture is now part of operational resilience.

Non-human identity sprawl creates the quietest ransomware corridor. Orphaned service accounts, dormant machine identities, and over-permissioned tokens are harder to see than user accounts and therefore easier to abuse. This is where ISPM becomes materially useful, because it exposes access relationships that conventional endpoint tools never model. The practical conclusion is simple: if service accounts can still reach production and backups without clear ownership, the environment is already over-exposed.

Identity Security Posture Management is the control plane ransomware teams actually need. Endpoint detection answers what executed, but ISPM answers whether the executing identity should have had the right at all. That distinction matters because attack containment begins with entitlement truth, not with log analysis after impact. Security leaders should stop treating identity governance as a compliance workflow and start treating it as a precondition for ransomware resistance.

Audit readiness and ransomware resilience now overlap at the identity layer. The same gaps that slow incident response also create weak audit evidence: unclear ownership, stale permissions, and broad access that nobody can justify quickly. That makes access governance a live operational control, not an annual review exercise. Teams that can prove who had access, why, and for how long will recover faster and absorb less blast radius.

Identity blast radius is the right named concept for this category. Once attackers hold legitimate credentials, the decisive question becomes how far those credentials can reach across SaaS, cloud, infrastructure, and backup systems. ISPM is valuable because it measures and reduces that blast radius instead of assuming the perimeter will hold. Practitioners should evaluate ransomware defence through the size of the identity blast radius, not just the number of blocked alerts.

From our research:

• Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, compared to nearly 1 in 4 for securing human identities, according to The State of Non-Human Identity Security.
• 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, with 38% reporting no or low visibility and 47% reporting partial visibility.
• That visibility gap is why teams should also review 52 NHI Breaches Analysis for the failure patterns behind abandoned access and credential abuse.

What this signals

Identity blast radius is becoming the more useful planning metric than endpoint coverage because ransomware now succeeds through authorised access paths. If teams cannot see which identities can reach backups, directory services, and production tooling, response speed will always lag attacker speed. That is why the control conversation has shifted toward live entitlement models and away from static spreadsheets.

With 85% of organisations lacking full visibility into third-party vendors connected via OAuth apps, the next ransomware event may arrive through a supply chain identity rather than a traditional compromise. That makes third-party access reviews, lifecycle offboarding, and NHI governance part of business continuity planning. Teams that still separate those disciplines will keep discovering the same issue too late.

Practitioners should expect identity posture management to move from a specialist control to a board-relevant resilience signal. As identity and ransomware converge, evidence of ownership, privilege scope, and access freshness will matter as much as detection tooling in incident reviews and audit cycles.

For practitioners

• Map every high-risk identity to real business ownership Build a live inventory of human and non-human identities that can reach production, backups, and directory services. If an account has no named owner or business purpose, treat it as an active ransomware exposure until it is validated or removed.
• Review service accounts with backup or admin reach Prioritise accounts that can administer systems, reset credentials, or touch backup repositories. Those accounts often create the shortest path from legitimate access to encryption and recovery sabotage.
• Replace spreadsheet access reviews with graph-based entitlement checks Use an identity-to-data model to show who can access which systems, from where, and through which accounts. That reduces the time needed to answer audit questions and to contain identity-driven ransomware paths.
• Separate endpoint detection from identity containment decisions When suspicious activity appears, verify whether the identity behind it had legitimate standing access, and revoke or constrain reach accordingly. EDR should inform the response, but entitlement context should drive the containment action.

Key takeaways

• Ransomware is now an identity abuse problem because attackers increasingly use valid accounts, unmanaged NHIs, and over-permissioned access paths.
• The evidence points to a major control gap, with 83% of attacks compromising identity infrastructures and 30% involving identity-based tactics.
• Identity Security Posture Management changes the response model by exposing who can do what before ransomware turns access into outage.

Key terms

• Identity Security Posture Management: Identity security posture management is the continuous assessment of identity configuration, privilege, and exposure across an environment. It focuses on drift, overprivilege, and control gaps so teams can see where IAM, PAM, and NHI governance are failing before those gaps become incidents.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
• Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
• Standing Access: Standing access is persistent privilege that remains available without fresh approval or contextual checks. In NHI environments, standing access usually appears as long-lived tokens, reusable service accounts, or broad roles attached to automation. It is convenient operationally, but it expands risk when conditions change or secrets leak.

What's in the full article

Veza's full article covers the operational detail this post intentionally leaves for the source:

• The specific ISPM workflow for mapping every identity to entitlements across SaaS, cloud, and infrastructure
• The identity-to-data graph approach used to surface dormant, orphaned, and over-permissioned accounts
• Practical examples of policy simulation before rollout, including how to avoid access changes that break production
• Audit export examples that turn least-privilege evidence into something teams can hand to auditors quickly

👉 Veza's full article covers the identity graph, creep control, and audit workflow details behind the argument.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.