Ransomware exposure is still being amplified by identity gaps

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Imprivata's blog post: Ransomware impact keeps growing when identity controls leave room for lateral movement, delayed containment, and privileged access abuse.

Why it matters: It matters because IAM, PAM, and NHI teams are now part of ransomware containment, not just post-incident recovery, especially where one credential can expand blast radius.

By the numbers:

• In 2024, ransomware is expected to cause more than $40 billion in losses for US businesses.
• The British Library said it would use about 40% of its reserves, roughly 6 to 7 million pounds, to recover from the attack.

Context

Ransomware is no longer just a malware problem. In practice, it is an identity and access problem that determines whether an intruder can move from one compromised account to a broader operational shutdown.

Imprivata frames the issue through business damage, but the operational control point is still access: if a single identity can open privileged paths, ransomware turns from a file encryption event into enterprise-wide disruption.

The article is typical of current ransomware guidance in one important respect: it treats recovery, access control, and operational continuity as linked rather than separate workstreams.

Key questions

Q: What breaks when ransomware operators can reuse one compromised identity across multiple systems?

A: Containment breaks first. A single reusable identity lets attackers move from entry to privilege escalation without triggering obvious anomalies, especially when access is broad or persistent. That is why ransomware resilience depends on eliminating standing privilege, shortening session scope, and ensuring compromised credentials cannot reach backups, admin planes, and vendor-connected systems.

Q: Why do privileged accounts make ransomware harder to contain?

A: Privileged accounts let attackers turn one foothold into broad operational access. If admin rights are standing, reused, or too widely assigned, the attacker can map sensitive systems and reach backup, directory, or deployment infrastructure faster. That is why privilege scope and revocation speed matter more than simply counting detections.

Q: How can security teams tell whether entitlement governance is actually reducing ransomware risk?

A: They should look for fewer dormant accounts, fewer unmanaged service identities, and fewer toxic access combinations that could reach backup, admin, or data systems. If those patterns remain visible, the programme is measuring activity, not risk reduction. Effective governance is reflected in shrinking blast radius, clearer ownership, and faster revocation.

Q: What is the difference between ransomware resilience and backup resilience?

A: Backup resilience asks whether data can be restored. Ransomware resilience asks whether the organization can restore trust, authority, and control fast enough to use those backups safely. Identity governance sits between the two because compromised sessions and over-privileged accounts can prevent recovery even when backups are intact.

Technical breakdown

How ransomware turns one identity into a wider outage

Modern ransomware campaigns rarely rely on encryption alone. They often begin with one credential, session, or privileged foothold, then use that access to reach file shares, endpoints, backups, and administrative consoles. Once inside, the attacker’s advantage comes from what the identity can already touch, not just from the malware payload. That makes the access graph the real attack surface: the more standing privilege and shared access a user or service account has, the faster ransomware can spread before defenders notice. In identity terms, the failure is not only compromise, but uncontrolled reach after compromise.

Practical implication: reduce the access radius of every identity that can reach critical systems or backups.

Why privileged access speeds lateral movement

Privileged access management matters because ransomware operators look for accounts that let them traverse the environment without repeated authentication friction. If an admin, vendor account, or service credential can interact broadly across systems, the attacker does not need a new exploit for every target. They can pivot by using legitimate permissions in illegitimate ways. This is why ransomware often becomes an identity governance failure after the initial intrusion. The decisive control is not only detection, but whether privilege was already constrained enough to block movement between systems, domains, and operational tiers.

Practical implication: separate privileged paths from routine user access and tightly scope every elevated entitlement.

Why recovery depends on identity governance, not just backups

Backups help only if the attacker cannot disable them, encrypt them, or use the same credentials to corrupt the restore path. Ransomware incidents increasingly expose weak separation between production access and recovery access, especially where the same identities can administer both. That is an identity design flaw, not just a disaster recovery gap. Strong segmentation, unique privileged accounts, and access controls for vendor and administrator workflows determine whether restoration is possible before extortion pressure peaks. Without that separation, recovery becomes slower, more expensive, and easier for attackers to obstruct.

Practical implication: treat backup and restore pathways as privileged assets with their own access controls and review cycles.

Threat narrative

Attacker objective: The attacker wants to maximise operational disruption and extortion leverage by expanding from one identity foothold into systems the organisation cannot quickly isolate or restore.

1. Entry often starts with a compromised user or vendor identity that gives the attacker legitimate initial access to the environment.
2. Credentialed access is then used to locate higher-value systems, disable protections, and expand into adjacent administrative paths.
3. Lateral movement through over-permissioned identities lets the attacker reach backups, shared services, and operational systems before detection.
4. The impact is encryption, service outage, and in many cases data theft or extortion pressure built on the threat of publication.

Breaches seen in the wild

• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
• CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Ransomware is increasingly an identity blast-radius problem, not just a malware event. Once an attacker gains one usable identity, the practical question becomes how far that identity can move before containment. That changes the control objective from clean-up after encryption to limiting reach before encryption can spread. For IAM and PAM teams, the measure of success is not authentication alone but how tightly identity paths are segmented.

Privileged access becomes the acceleration layer for ransomware. When elevated accounts can traverse systems, attackers do not need to break each target independently. The real governance failure is standing privilege that still assumes the identity is benign after compromise. That assumption no longer holds in ransomware operations, where legitimate permissions are routinely converted into lateral movement.

Recovery controls must be governed as privileged identity workflows. Backup repositories, restore consoles, and vendor support channels all become high-value targets once ransomware operators understand the access model. If the same identities can administer production and recovery, resilience is weaker than it appears on paper. Practitioners should treat recovery access as a separate trust domain, not a convenience layer.

Identity gaps are what turn double extortion into enterprise leverage. Encryption and data theft are different attack outcomes, but both depend on the attacker reaching sensitive systems and data faster than the organisation can isolate them. Identity blast radius: the real unit of ransomware risk is the scope of access available to each account before containment. Teams that cannot measure that scope cannot meaningfully bound ransomware impact.

Ransomware governance now spans human, NHI, and vendor identities. User accounts, service accounts, and third-party access paths all contribute to the same attack surface when privilege is not tightly segmented. That makes identity lifecycle discipline a ransomware control, not a back-office hygiene task. Organisations that still separate those disciplines are leaving the widest path open to extortion actors.

What this signals

Identity blast radius is the control variable that ransomware programmes still under-measure. When one account can traverse production, backup, and support environments, the attacker does not need a novel exploit chain to cause major damage. The programme response should be to map which identities can still reach high-value recovery assets and then shrink that reach before an incident forces the issue.

Ransomware readiness now depends on whether IAM, PAM, and vendor access are designed for compromise containment, not just routine operations. Organisations that still treat those as separate disciplines will struggle to prove that one compromised account cannot become an enterprise outage.

For practitioners

• Tighten lateral-movement paths Remove broad cross-system access from admin, vendor, and service identities so one compromised account cannot reach backups, shared services, and security tooling in the same path.
• Separate recovery from production access Use distinct credentials, approval paths, and administrative boundaries for backup and restore operations so ransomware operators cannot tamper with the recovery plane using production access.
• Reduce standing privilege Review elevated entitlements that remain active outside short maintenance windows and rework them into task-scoped access where possible.
• Harden third-party access Apply zero-trust style controls, session monitoring, and credential obfuscation to vendor-access pathways that could otherwise become an initial ransomware pivot.
• Test restoration under identity failure Run recovery exercises that assume privileged identities are compromised, then verify which systems can still be restored without reusing the same access paths.

Key takeaways

• Ransomware impact is amplified when identity controls allow one compromise to spread across systems, backups, and privileged tooling.
• The article pairs business damage with access risk, including more than $40 billion in expected US losses in 2024 and sharply rising ransom demands.
• Teams should govern privileged and recovery access as separate control planes so containment still works after an identity is compromised.

Key terms

• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
• Lateral Movement: A post-compromise technique where an attacker uses a compromised NHI to move through a network, accessing additional systems and escalating impact without triggering detection.
• Recovery Plane: The recovery plane is the set of systems, identities, and workflows used to restore operations after an incident. It is a privileged environment, because anyone who can alter restore behaviour can shape the organisation’s ability to recover safely and on time.
• Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.