Identity security v2 means control before compromise, not after

At a glance

What this is: The article argues that identity security must shift from reactive remediation to proactive control, because account compromise still dominates initial access even as spending rises.

Why it matters: IAM, PAM, and NHI teams need control-plane thinking across human and non-human identities, because fragmented, post-compromise tooling leaves blast radius and exposure unmanaged.

By the numbers:

• Despite spending more than $18.5 billion on identity security products in 2024, identity remains the most common entry point for attackers.
• This year alone, there have been over 800 million new sets of stolen credentials compromised as a result of the explosion of infostealers.
• 80% of identity breaches involved compromised non-human identities such as service accounts and API keys.

👉 Read Silverfort's analysis of why identity security v2 is needed now

Context

Identity security has often been treated as a control layer for onboarding, compliance, and password policy, but the article argues that this model no longer matches attacker behaviour. The primary gap is not visibility alone, but the inability to enforce identity controls in real time across human identities, service accounts, and other non-human identities.

In practical terms, the problem is that many organisations still layer detective and reactive tools over already exposed identity estates. That leaves account compromise, privilege misuse, and stale access in place long enough for attackers to turn identity into a reliable entry point rather than a governed control point.

Key questions

Q: How should security teams reduce account takeover risk in digital identity programmes?

A: They should treat takeover as a lifecycle problem, not only an authentication problem. Strengthen proofing, step-up checks, recovery flows, and transaction approval so that a valid session does not automatically equal a trusted action. The strongest programmes align identity assurance with the value of the action being protected.

Q: Why do identity security programmes keep falling behind account compromise?

A: Because many programmes still optimise for compliance and operational convenience instead of real-time security control. That creates fragmented tooling, slow remediation, and access that remains useful long after it should have been revoked. Attackers benefit from that delay, especially when credentials are stolen at scale.

Q: What problem does ownership attribution solve for service accounts and API keys?

A: It closes the gap between exposure detection and accountable remediation. Many organisations can find the secret, but not the human who introduced it, maintains it, or can safely replace it. Ownership attribution gives security teams a practical way to assign action without relying on informal knowledge that disappears during staff changes.

Q: Who is accountable when identity risk causes measurable business impact?

A: Accountability sits with the teams that own identity governance, privileged access, and security risk decisions, not with the alerting tool alone. Organisations should define who can translate identity findings into financial exposure, who approves remediation, and who is responsible for containment when a privileged identity is compromised.

Technical breakdown

Why identity security v1 keeps failing at the control plane

Identity security v1 is a fragmented model that treats identity as a backlog of vulnerabilities, isolated privileged accounts, and alertable events. That approach breaks because identity is dynamic: access changes, credentials age, service accounts proliferate, and attackers move faster than remediation cycles. A control plane model does not wait for compromise to be detected. It sets enforceable policy at the point of authentication and access, then applies those policies consistently across environments. The article’s core point is that security posture cannot be inferred from compliance activity or isolated PAM coverage; it must be measurable as enforced access control.

Practical implication: identity teams should measure whether they can enforce policy before access is granted, not only after an alert fires.

How deny-by-default changes authentication risk

Authentication is usually designed for availability, not security. Deny-by-default flips that assumption by making access contingent on trusted source, approved protocol, and explicit policy. In identity terms, this reduces the blast radius because credentials alone are not sufficient to establish access everywhere. The model is especially relevant where legacy protocols, unmanaged remote access paths, or broad trust relationships still exist. The article’s examples, such as MFA for sensitive infrastructure and blocking insecure protocols, show that security-first authentication is about shrinking the set of reachable resources before compromise can spread.

Practical implication: enforce source, protocol, and MFA policy at authentication boundaries that currently rely on user or device trust.

Identity blast radius as a measurable security objective

Blast radius is the amount of damage an identity can cause once compromised. For human accounts, that includes privileged sessions and over-provisioned access. For non-human identities, it includes service account permissions, token scope, and lateral reach into cloud or SaaS systems. The article implicitly argues that the right security target is not perfect prevention, but reduced reach and narrower impact when compromise occurs. That is why ephemeral credentials and zero standing privilege matter: they convert identity from a persistent access path into a bounded, shorter-lived control point.

Practical implication: inventory the highest-blast-radius accounts first and redesign them for shorter-lived, narrower access.

Threat narrative

Attacker objective: The attacker aims to turn identity into the first and most reliable path to persistence, privilege, and business disruption.

1. entry through stolen credentials, infostealer harvest, or exposed identity data that attackers can use quickly after disclosure.
2. escalation through excessive privilege, legacy authentication, or broad trust relationships that let the attacker move beyond the initial account.
3. impact through account compromise, lateral movement, and persistent access to cloud, SaaS, or internal systems before remediation catches up.

Breaches seen in the wild

• MITRE ATT&CK Enterprise Matrix — MITRE ATT&CK Enterprise — adversary tactics and techniques, threat detection, attack chain mapping, credential access, lateral movement, privilege escalation.
• Cisco DevHub NHI breach — IntelBroker exploited exposed Cisco credentials, API tokens and keys in DevHub.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity Security v2 is a control-plane shift, not a tool refresh. The article is right that layered detection and isolated remediation are not enough when attackers treat identity as the fastest route into the environment. Security teams need a model where authentication policy, privilege scope, and trust boundaries are enforced continuously. The practitioner conclusion is that identity must operate as a runtime control plane, not a cleanup queue.

Standing privilege is the failure mode this article is really describing. When access persists after the business need has passed, attackers inherit a ready-made path from compromise to impact. That is true for human users and even more dangerous for service accounts and API keys that are left with broad permissions. The practitioner conclusion is that exposure is not just about stolen credentials, but about credentials that remain useful long after they should have expired.

Identity blast radius should replace exposure count as the organising metric. An organisation can have many controls in place and still allow one compromised account to reach too much of the environment. The article’s own examples, MFA, trusted sources, and deny-by-default, all point to one outcome: reducing how far a single identity can move. The practitioner conclusion is to rank identities by damage potential, not by inventory size.

Identity security has become a governance problem as much as a detection problem. The article shows that accountability is hard when teams cannot answer what residual risk remains or when the environment will be “done.” That is a sign that identity programmes still lack enforceable control objectives. The practitioner conclusion is that governance must specify who can approve, observe, and revoke access before compromise becomes operational.

Ephemeral credentials change the economics of compromise. Short-lived access, zero standing privilege, and denial by default all reduce the value of stolen identity material. That does not eliminate attacker intent, but it compresses the useful window. The practitioner conclusion is that identity programmes should favour access states that are difficult to reuse, not merely easier to audit.

From our research:

• 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to Ultimate Guide to NHIs.
• From our research: Only 5.7% of organisations have full visibility into their service accounts, according to Ultimate Guide to NHIs.
• From our research: Explore the 52 NHI Breaches Analysis for breach patterns that show how excessive privilege becomes real-world impact.

What this signals

Identity Security v2 is where prevention starts to outgrow remediation. The programme-level signal is that IAM teams can no longer rely on post-incident cleanup or periodic recertification to control attacker movement. When identity compromise remains the dominant entry path, the operating model must shift toward continuous enforcement at the point of access.

With 5.7% of organisations having full visibility into their service accounts, the governance gap is already operational. That figure points to a structural blind spot, not a tooling inconvenience. The practical signal is that many enterprises cannot confidently say which non-human identities can still authenticate, let alone how far they can reach.

Identity blast radius should become a board-level metric tied to Why NHI Security Matters Now. That framing helps security leaders translate technical controls into business risk. It also aligns access governance with the reality that a single compromised identity can be far more damaging than a larger number of low-risk accounts.

For practitioners

• Define a control-plane target state Document where identity policy must be enforced at the point of authentication, not only in downstream reviews or incident response. Use that target state to identify the systems still operating as reactive remediation queues.
• Reduce standing privilege first Prioritise the accounts with the broadest reach, including admin accounts, service accounts, and API credentials that remain valid beyond a single task. Rework them toward shorter-lived access and narrower scopes.
• Block legacy and insecure authentication paths Identify protocols, trust sources, and login flows that allow access without modern policy checks. Close or isolate those paths before they become the easiest route for credential replay and lateral movement.
• Measure identity by blast radius Classify accounts by the systems and data they can reach if compromised, then use that ranking to drive remediation order. A small number of high-blast-radius identities usually deserves first attention.
• Adopt ephemeral access for high-risk use cases Use ephemeral credentials and zero standing privilege where the business task is time-bound and the risk of reuse is high. This reduces how long stolen identity material remains useful to an attacker.

Key takeaways

• Account compromise remains the default attacker entry point because identity programmes still lean on fragmented, reactive controls.
• The scale of stolen credentials and the prevalence of excessive NHI privilege show that exposure is already systemic, not edge-case.
• Security teams need a control-plane approach that narrows blast radius, enforces deny-by-default access, and shortens the value window of every credential.

Key terms

• Identity Control Plane: An identity control plane is the governance layer that decides who or what can access systems and under what conditions. In practice, it coordinates authentication, authorization, privilege review, and lifecycle management across human and machine identities so access policy is enforced consistently across environments.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
• Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.

What's in the full article

Silverfort's full article covers the operational detail this post intentionally leaves for the source:

• A fuller breakdown of the Identity Security v1 to v2 argument and the business case behind it.
• The specific control examples used to illustrate deny-by-default identity policy in practice.
• The article's explanation of how identity teams can move from fragmented tools to measurable control.
• The surrounding context on why account compromise persists even with higher identity security spend.

👉 Silverfort's full article expands on the control model, attack context, and practical identity-first security stance.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an identity security programme, it is worth exploring.