TL;DR: Ransomware defence remains reactive for many organisations, and Delinea cites research showing only 34% have adopted least privilege, leaving broad pathways for lateral movement, unauthorized software, and compromised suppliers to expand impact. That gap matters because identity-first controls still shape how far ransomware can travel once an account or system is breached.
At a glance
What this is: This is Delinea’s argument that least privilege remains an underused ransomware control because it shrinks attack surface, limits lateral movement and constrains third-party exposure.
Why it matters: IAM, PAM and NHI teams need to treat identity permissions as a ransomware containment layer, because broad entitlements turn one compromised account or system into network-wide blast radius.
By the numbers:
- Only 34% of organizations have adopted a least privilege approach, according to Delinea.
Context
Least privilege is the principle that users and machines should only receive the access they need to do a specific job. In ransomware defence, that means the difference between a contained compromise and an environment where one foothold can spread through shared permissions, writable paths and overexposed administrative reach.
Delinea frames the problem as an identity-first gap, not just a malware problem. The article argues that as cloud assets, remote work, IoT devices and agentic AI expand the attack surface, the real weakness is still excessive access and weak containment at the identity layer.
The article’s core claim is operational rather than theoretical: many organisations are still reacting after encryption or disruption begins, instead of narrowing what ransomware can touch before execution starts. That makes this a governance issue for IAM, PAM and NHI programmes, not only for incident response teams.
Key questions
Q: What breaks when privileged access is still widely standing during a ransomware attack?
A: When privileged access is standing, ransomware actors can reuse high-value credentials without waiting for elevation workflows or human approval. That breaks the containment model because the attacker can reach backup systems, domain-level controls, and recovery tooling before defenders interrupt the chain.
Q: Why do privileged accounts make ransomware harder to contain?
A: Privileged accounts let attackers turn one foothold into broad operational access. If admin rights are standing, reused, or too widely assigned, the attacker can map sensitive systems and reach backup, directory, or deployment infrastructure faster. That is why privilege scope and revocation speed matter more than simply counting detections.
Q: What are the signs that a password and privilege programme is failing against ransomware?
A: A failing programme usually shows up as password sprawl, delayed password changes, locally stored credentials, and excessive standing access. If teams cannot rapidly trace privileged actions back to a person or workload, or if old credentials remain usable for long periods, the environment is still exposed. Those are strong signals that identity controls are not keeping pace with attacker methods.
A: Security teams should treat least privilege as an ongoing control, not a one-time role assignment. The practical goal is to encode business context, review access continuously, and revoke or reduce permissions when risk changes. That approach matters most in environments with many applications, cloud services, and service accounts where standing access quickly becomes excessive.
Technical breakdown
How least privilege limits ransomware blast radius
Least privilege reduces what ransomware can do after an initial account or system compromise. If a user, service account or device can only reach the resources required for its function, the malware cannot freely install software, traverse shares, or enumerate every adjacent system. The control works by shrinking the number of executable paths available to an attacker, not by detecting the payload itself. In practice, this is why identity scope matters as much as endpoint hardening. When access is broad, the attacker inherits broad reach; when access is narrow, the compromise stays operationally small.
Practical implication: map high-value accounts and workloads to the minimum permissions they actually require.
Why lateral movement depends on permission design
Ransomware becomes materially worse when internal permissions let an intruder pivot from one compromise to another. Lateral movement is often enabled by shared administrative access, over-permissioned users, or machine accounts that can read and modify more than their role requires. Least privilege interrupts that chain by reducing reachable systems and blocking the default assumption that a single authenticated identity should be trusted everywhere. This is where zero trust becomes relevant: continuous verification only helps if the identity itself does not already possess unnecessary reach. Otherwise, the attacker moves as the identity, not around it.
Practical implication: review internal access paths that would let one compromised identity reach multiple systems.
How third-party access and agentic AI expand exposure
Delinea’s article extends the least privilege problem beyond employees to suppliers, machines and emerging agentic AI use cases. Third-party access is dangerous when external parties retain more access than their task requires, especially if supplier accounts are not tightly constrained or reviewed. The same logic applies to autonomous or semi-autonomous systems that act with persistent credentials: broader permissions increase the chance that a compromise or misuse becomes an enterprise-wide issue. The governance challenge is not just who can log in, but whose access can be abused to install, modify or propagate ransomware.
Practical implication: constrain supplier, workload and agent access separately from human user access.
Threat narrative
Attacker objective: The attacker wants to maximise spread, disruption and leverage by turning one compromised identity into broad operational impact.
- Entry occurs when a user, machine or third-party account is compromised and the attacker inherits the identity’s existing permissions.
- Escalation follows when over-privileged access lets the ransomware operator install software, access additional systems or stage destructive actions.
- Impact arrives when the malware spreads across reachable assets and the organisation loses containment before response can isolate the blast radius.
Breaches seen in the wild
- Azure Key Vault Contributor escalation 2024: Datadog found Azure Key Vault Contributor could add itself to access policies and read every secret, key and certificate in a vault.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Least privilege is now a containment control, not just an access hygiene control: ransomware defence fails when identity scope is treated as administrative convenience instead of an attack boundary. The article correctly frames the issue as blast-radius reduction, because the decisive question is how far a compromised identity can travel before containment kicks in. That makes access governance part of resilience planning, not an afterthought.
Identity-first security only works when permissions are continuously bounded: Delinea’s emphasis on IAM governance, CIEM and ITDR reflects a broader reality. Static role design is not enough when cloud growth, remote work and supplier access keep changing the reachable surface. Practitioners need to treat privilege drift as a ransomware exposure indicator, not just an audit finding.
Third-party and machine access are the same governance problem at different trust edges: supplier accounts, workloads and human users all become ransomware amplification paths when access exceeds task scope. The real failure mode is not the identity type, but the persistence of unnecessary reach across them. Teams should govern all of those pathways under one least-privilege model, while preserving separate review and containment rules.
Least privilege should be measured by exploitability, not policy existence: many organisations say they have privilege controls while still leaving broad install rights, lateral pathways and supplier access in place. The article’s 34% figure shows the category gap, but the deeper issue is whether those controls actually reduce what an attacker can do after compromise. IAM leaders should measure effective containment, not just control adoption.
Named concept: identity blast radius: the amount of damage a compromised identity can do before detection or isolation. Ransomware programmes that do not actively reduce identity blast radius are still optimised for recovery after spread, rather than prevention of spread. Practitioners should make this the central metric for least privilege work across human, machine and third-party access.
From our research library:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
- Read next: NHI Lifecycle Management Guide
What this signals
Identity blast radius: ransomware programmes should now be judged by how far a compromised identity can move, not only by whether malware is detected. When permissions are too broad, containment fails at the access layer and incident response starts too late to matter.
Least privilege is increasingly a governance test for IAM, PAM and NHI teams because the same excessive-access pattern appears in human accounts, workloads and supplier identities. The programme question is whether your current controls actually reduce reachable systems after compromise, not whether they exist on paper.
For practitioners
- Define ransomware containment scopes by identity type Separate human, machine and supplier access models so each identity category gets its own minimum permission boundary and review cycle.
- Remove unnecessary install and admin rights Identify users and systems that can install software or modify endpoints without a task-specific need, then narrow those rights to reduce ransomware entry points.
- Constrain lateral movement paths Review where one authenticated identity can reach many internal systems, especially shared administration paths and writable network locations.
- Separate third-party access governance Apply tighter approvals, shorter access windows and explicit scope limits to supplier identities that should never carry broad internal reach.
- Measure effective containment, not policy coverage Track whether compromised identities can still spread, install or access data beyond their role, and use those findings to prioritise privilege reductions.
Key takeaways
- The article’s core message is that ransomware defence still breaks at the identity layer when organisations allow accounts and systems more access than they need.
- Delinea cites a 34% least-privilege adoption rate, which helps explain why broad internal reach remains common enough to matter operationally.
- The control value is containment: reducing install rights, lateral paths and third-party reach limits how much damage one compromise can cause.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | The article centers on excess access as the main ransomware enabler. |
| NHI-10 — Human Use of NHI | Third-party and machine access are part of the same privilege problem as human misuse paths. | |
| Recommendation — Review NHI entitlements for excess reach and remove permissions that are not required for the task. Separate human control paths from machine and supplier access to prevent broad identity reuse. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Least privilege is the explicit control principle the article argues is underused. |
| Recommendation — Apply AC-6 to restrict access to the minimum necessary and review privilege scope continuously. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is fundamentally about whether access permissions are bounded well enough to contain ransomware. |
| Recommendation — Use PR.AA-05 to govern entitlements so compromised identities cannot freely expand their reach. | ||
| MITRE ATT&CK | TA0008 — Lateral Movement | The article explicitly cites blocking lateral movement as a ransomware containment outcome. |
| Recommendation — Map privilege reductions to TA0008 and prioritise the paths that let one compromise reach many systems. | ||
Key terms
- Least Privilege: A security principle requiring that every identity, human or non-human, is granted only the minimum permissions necessary to perform its function. Least privilege is the single most effective control for reducing NHI blast radius.
- Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
- Lateral Movement: A post-compromise technique where an attacker uses a compromised NHI to move through a network, accessing additional systems and escalating impact without triggering detection.
- Identity-first security: Identity-first security is an approach that treats identity as the primary control plane for managing risk. Instead of relying mainly on network or endpoint boundaries, it uses identity context to decide what can happen, when it can happen, and under what conditions. That model is especially relevant where privileges move across human, non-human, and agentic actors.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 24, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org