Modern IGA would have reduced the damage in recent breaches

At a glance

What this is: This review connects ten recent breaches to repeated IGA failures such as stale credentials, missing MFA, over-privileged accounts, and weak third-party access.

Why it matters: It matters because the incidents show that identity governance is still where many high-impact breaches begin, which puts NHI, human IAM, and third-party access programmes under the same operational pressure.

👉 Read Opal Security's analysis of the recent breaches modern IGA could have reduced

Context

Identity governance failures create breach paths when access remains active beyond its intended purpose, privileges are broader than the job requires, or MFA and review controls are missing. In this review of recent incidents, the pattern is not a lack of security technology but a lack of lifecycle control over who or what can still act inside the environment.

The article argues that modern IGA would have reduced the damage in ten major breaches spanning 2023 to 2025. That framing matters for IAM teams because it shifts attention from isolated compromise events to repeated control failures across human accounts, service accounts, third-party access, and legacy systems.

Key questions

Q: What breaks when stale credentials and missing MFA are still allowed in production?

A: They create durable entry points that attackers can reuse long after the original leak or theft. Without MFA and timely revocation, the account itself becomes the control failure, especially when it can reach remote access portals, SaaS platforms, or support systems. The practical risk is that one exposed credential can become the first step in a much larger compromise.

Q: Why do overprivileged accounts make breaches harder to contain?

A: Because the compromise of one account becomes the compromise of whatever that account can already reach. Broad permissions shorten an attacker’s path to sensitive systems, increase lateral movement options, and make detection slower to matter. Least privilege reduces the blast radius by limiting what a stolen identity can do.

Q: How do you know if an access review programme is actually working?

A: Look beyond completion rate. A working programme shows fast detection-to-remediation time, meaningful percentages of access changed or revoked, and low rates of blanket approval from reviewers. If identified risk remains open for weeks or audit evidence is hard to reconstruct, the programme is producing activity but not control.

Q: What should organisations do when third-party access outlives the business need?

A: Treat the access as a lifecycle problem, not a one-time approval. Revalidate vendor and contractor access whenever scope, ownership, or service relationships change, and remove support paths that no longer match the current engagement. That is how organisations prevent outsourced access from becoming a standing breach pathway.

Technical breakdown

Stale credentials and missing MFA create durable entry paths

Stolen or unrotated credentials remain effective long after initial exposure when MFA is not enforced and access is never revalidated. In the incidents cited here, attackers repeatedly used older credentials, legacy portals, and dormant accounts to get in without having to defeat a strong control chain. In identity terms, the failure is not merely authentication weakness. It is the combination of unmanaged credential lifecycle and permissive access continuation that leaves an account usable long after the original trust decision should have expired.

Practical implication: treat credential age, MFA coverage, and revocation latency as linked control signals, not separate hygiene tasks.

Over-privileged service accounts widen the blast radius

When a service account or legacy application holds more access than its function requires, compromise becomes a platform problem rather than a single-account problem. The article’s examples show how elevated OAuth scopes, support-system credentials, and unattended test accounts can expose email, SaaS data, and internal documents once attackers obtain any one foothold. This is a classic non-human identity issue: the account itself is not the threat, but its standing privilege becomes the mechanism that turns a limited intrusion into broader compromise.

Practical implication: inventory non-human identities and reduce privilege scope before those accounts become lateral movement accelerators.

Third-party access needs lifecycle control, not one-time trust

Vendor and contractor access becomes risky when it is granted broadly, left in place after the business need changes, or allowed to bypass the same checks applied to employees. Several incidents in the article involve outsourced support, business process outsourcing, or remote support services where the access path was legitimate but insufficiently constrained. The governance gap is lifecycle blindness: access was assigned, but not continuously re-justified, segmented, or removed when the relationship or role shifted. That is why third-party access must be governed as an ongoing entitlement, not a static exception.

Practical implication: align third-party access reviews, segmentation, and offboarding to the actual duration and scope of vendor work.

Threat narrative

Attacker objective: The objective is to convert a single identity failure into durable access, broad data exposure, and operational disruption.

1. Entry occurred through stolen credentials, missing MFA, socially engineered resets, or compromised third-party access, depending on the incident.
2. Credential access then expanded the attacker’s reach because the exposed accounts or tokens already carried standing permissions.
3. Escalation followed when over-privileged service accounts, legacy OAuth access, or broad support-tool entitlements exposed more sensitive systems and data.
4. Impact ranged from ransomware and data theft to prolonged unauthorized access, operational disruption, and large-scale customer exposure.

Breaches seen in the wild

• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
• CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Modern IGA is now a breach containment control, not just an admin function. The incidents in this review show that access governance failures are doing the work of exploitation for attackers. When credentials are stale, MFA is missing, or accounts are never re-reviewed, adversaries do not need a novel exploit to reach sensitive systems. The practitioner conclusion is that IGA has become part of the breach prevention stack, not a back-office entitlement process.

Standing privilege is the common condition that turns small exposures into enterprise-scale losses. Across human, service, and third-party accounts, the repeated pattern is persistent access that outlives the business need. That creates a wider identity blast radius because any stolen credential or abused account already has the power to reach further than it should. The conclusion for governance teams is that access scope, not just access existence, must be continuously constrained.

Third-party access without lifecycle offboarding is a structural governance failure. The article shows how outsourced support, vendor tooling, and acquired infrastructure all become durable attack surfaces when access is granted once and then forgotten. This is especially visible when a relationship changes but permissions remain live. The conclusion is that third-party governance must be measured by revocation discipline, not by initial approval quality.

Access review programmes fail when they review the wrong thing at the wrong cadence. If a privileged account can remain active for months or years, then periodic certification alone will miss the exposure window that matters most. The modern IGA question is not whether access was approved, but whether it was still justified at the point of use. The conclusion is that governance must move from snapshot approval to continuous entitlement validation.

Identity blast radius is the right named concept for this breach pattern. The article’s examples show that the damage was amplified less by the initial entry point than by how much access each compromised identity already carried. That is why modern IGA has to be judged by how much it limits the impact of inevitable compromise. The practitioner conclusion is to design access governance around blast-radius reduction, not around one-time access assignment.

From our research library:

• Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.

What this signals

Identity blast radius is the governance metric that now matters most. The incidents in this review show that the real failure is not only how attackers got in, but how much access they inherited once they did. For IAM and IGA teams, the programme question is whether each account, token, and support pathway is constrained enough that a single compromise does not become an enterprise event.

Continuous entitlement validation should replace trust in static approvals. Periodic reviews remain useful, but they are too slow to catch access that becomes unsafe between cycles. Teams should focus on whether the entitlement is still justified at the moment it is used, especially for service accounts, vendor access, and legacy systems.

Lifecycle discipline is now the dividing line between tolerable and catastrophic identity risk. If access cannot be discovered, reviewed, narrowed, and removed at the pace business relationships change, then the organisation is carrying hidden breach exposure. That is true across human, non-human, and third-party access models alike.

For practitioners

• Audit credential age and MFA coverage Identify service accounts, SaaS logins, and legacy portals where credentials are old, unrotated, or not covered by MFA. Prioritise the accounts that can reach sensitive data or administrative surfaces first.
• Reduce standing privilege on non-human identities Review service accounts, OAuth apps, and support tooling for permissions that exceed the minimum required for the current task or integration. Remove broad scopes and legacy elevated access that no longer has a documented owner.
• Re-baseline third-party access after every relationship change Reconfirm vendor and contractor access whenever work changes, an engagement ends, or systems are acquired. Offboard unused access paths, separate support functions from customer data, and require explicit re-approval for privileged access.
• Move access reviews closer to issuance and use Shift from slow, periodic certifications to continuous entitlement monitoring for high-risk accounts. Flag accounts that remain active without recent use, approved ownership, or current business justification.

Key takeaways

• These breaches were not driven by a single new exploit pattern, but by repeated failures in identity governance and access control.
• The article ties ten incidents to more than 700 million affected individuals and billions of dollars in losses, showing the scale of the governance problem.
• The control lesson is to reduce standing privilege, enforce MFA, and make access review and offboarding continuous rather than periodic.

Key terms

• Identity Governance and Administration (IGA): A framework of policies, processes, and technology to manage and govern digital identities and their access rights. Increasingly extended to cover non-human identities alongside human users.
• Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.
• Access Review: A formal process for confirming whether access is still needed and justified. In IAM programs, the review becomes an evidence-bearing control when decisions are recorded, scoped correctly, and traceable to the right reviewer, application owner, or auditor.
• Third-Party Access Governance: Third-party access governance is the control set that tracks, approves, reviews, and revokes access granted to external vendors and partners. It becomes an identity problem when suppliers operate through shared credentials, delegated workflows, or persistent machine access that outlives the business need.

What's in the full article

Opal Security's full article covers the incident-by-incident access failures this analysis intentionally leaves at a higher level:

• Detailed breakdown of each of the ten breaches, including the specific identity control that failed in each case
• Per-incident impact figures, from customer counts to ransom payments and outage duration
• The vendor's mapped prevention logic for just-in-time access, access reviews, and third-party governance
• Examples of how legacy systems, service accounts, and outsourced support created recurring governance gaps

👉 Opal Security's full post walks through the ten incidents, their identity failures, and the prevention mapping in detail.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.