SafeBreach’s breach report reframes resilience through control validation

At a glance

What this is: SafeBreach says its inaugural breach report uses simulation data to show that identity abuse, lateral movement, and AI-driven infostealing are still slipping past enterprise controls.

Why it matters: For IAM, NHI, and security teams, the report matters because it shifts the measurement question from how many controls exist to whether those controls actually stop real attack paths.

Context

SafeBreach’s report is about a governance problem that many programmes still miss: control coverage is not the same as control effectiveness. A large inventory of tools, policies, and dashboards can still leave real attack paths open if they have never been validated under realistic conditions. The identity angle is direct, because the behaviours the report calls out include identity abuse and lateral movement through enterprise environments.

The report frames resilience as a measurement discipline, not a procurement exercise. That matters for IAM and NHI teams because access governance, credential controls, and detection engineering are often judged by presence and policy compliance rather than by whether they stop adversary behaviour in practice. The article’s starting position is typical of mature security teams that have plenty of telemetry but still need better proof of control performance.

Key questions

Q: What breaks when security controls are not validated against real attack paths?

A: When controls are not validated against real attack paths, teams can believe they have protection where gaps still exist. The article emphasises that dashboards are used to expose coverage and efficiency gaps, which means untested controls can leave blind spots in prevention, detection, and remediation. That leads to weak confidence in posture and delayed response to likely attack methods.

Q: Why do identity abuse and lateral movement matter so much in resilience testing?

A: They show whether legitimate access paths can be turned into operational compromise. If an attacker can move from one trusted identity or system to another, the environment has a containment problem, not just a detection problem. That is why IAM, PAM, and NHI controls need path-level testing, not just audit review.

Q: How do teams measure whether validation-driven security is actually improving resilience?

A: Teams should look for shorter time from threat emergence to tested response, fewer manual handoffs, and more decisions backed by environment-specific evidence. A stronger signal is when validation results feed remediation workflows and repeat testing confirms the same control gap does not recur. That shows the programme is changing security outcomes, not just producing reports.

Q: What should teams do when dashboards say coverage is high but validation shows failures?

A: Treat the validation result as the higher-fidelity signal and investigate the control path that failed. That usually means tightening privilege boundaries, correcting trust relationships, or reworking detection logic so the control blocks the attack stage that actually succeeded in testing.

Technical breakdown

Why validation is different from coverage reporting

Control coverage tells you that a safeguard exists. Validation tells you whether that safeguard actually blocks an attack path when an adversary uses real techniques, sequences, and timing. In breach and attack simulation, the point is not to model every possible threat perfectly but to test whether the environment resists observed attacker behaviour. That distinction matters because alerts, dashboards, and patch counts can all look healthy while a path remains open. For identity-heavy environments, the same logic applies to authentication, entitlements, and credential lifecycle controls: policy on paper is not proof of resistance.

Practical implication: Use validation to test whether identity and exposure controls stop realistic attack chains, not just whether they are deployed.

How identity abuse and lateral movement evade mature environments

Identity abuse usually succeeds when attackers can reuse legitimate access paths rather than break them. Once inside, lateral movement depends on weak segmentation, excessive entitlements, shared trust, or poor privilege boundaries between systems and accounts. These failures are often hidden because they look like ordinary administration or service activity until they are chained together. The report’s focus on identity abuse and lateral movement is important because it shifts attention from endpoint compromise alone to the access graph that lets an attacker expand reach after initial foothold. In practice, the risk is often architectural, not just behavioural.

Practical implication: Map and test the trust relationships that allow one compromised identity to reach another system or workload.

Why AI-driven infostealing changes resilience testing

AI-driven infostealing raises the speed and scale of reconnaissance, collection, and social engineering around credential theft. The core issue is not that AI creates a new class of attack from nothing, but that it reduces friction for harvesting information and turning stolen access into operational advantage. That makes traditional control assumptions weaker, especially where teams still rely on periodic review rather than continuous proof of resistance. If defenders do not test how well controls behave against automated or AI-assisted tradecraft, they may understate how quickly identity data and session material can be abused.

Practical implication: Include AI-assisted collection and credential-theft scenarios in validation programmes so control testing reflects current attacker speed.

Threat narrative

Attacker objective: The objective is to expand access and persist inside mature enterprise environments without triggering controls that only look effective on dashboards.

1. Entry occurs through stealthy behaviours such as identity abuse or AI-assisted infostealing that do not immediately resemble overt malware activity.
2. Credentialed access is then used to move laterally across trusted systems, exploiting gaps in entitlements, trust boundaries, or segmentation.
3. The impact is silent success against environments that appear covered on paper but fail to stop real attack paths in practice.

Breaches seen in the wild

• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
• CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Validation is now the more defensible resilience metric than control inventory. Security programmes can own many tools and still fail against realistic adversary behaviour if they never test those controls under attack conditions. The report’s core value is that it replaces assumption with proof, which is exactly where modern governance needs to move. Practitioners should treat validated control performance as the baseline for risk decisions.

Identity abuse is a control-efficacy problem, not just a detection problem. When legitimate credentials, entitlements, or access paths are abused, the weakness is often the lack of constraining controls around who can reach what and under which conditions. That makes IAM, PAM, and NHI governance central to resilience measurement, because the access graph is where attackers often gain durable advantage. Practitioners should validate the boundaries, not just log the events.

AI-driven infostealing exposes a measurement gap in many security programmes. Teams that still benchmark themselves on tools deployed, alerts generated, or patch closure are measuring effort, not resistance. The report points to a broader governance shift toward outcome-based assurance, where defenders ask whether controls stop current tradecraft. Practitioners should reframe executive reporting around tested resistance to real attack behaviours.

Stealthy lateral movement reveals where segmentation and privilege models are overstated. Many mature enterprises have layered architectures, but layered does not mean verified. If one compromised identity can still traverse internal trust relationships, the control model is incomplete. Practitioners should use this as a prompt to test path-level resistance across hybrid estates and not assume architecture diagrams reflect actual containment.

Control validation should become the common language across security, IAM, and resilience teams. The report’s strongest contribution is methodological: it provides a way to compare environments using evidence rather than anecdotes. That matters for budget prioritisation, board reporting, and incident preparedness because it links control behaviour to measurable exposure. Practitioners should build governance around validated outcomes, not inferred assurance.

What this signals

Control validation is becoming the most useful bridge between security operations and identity governance. If a team cannot prove that its access, privilege, and exposure controls stop realistic attack paths, the programme is still relying on assumptions. For IAM and NHI leaders, the practical shift is to measure resistance at the point of use, not just during review cycles.

Identity abuse should be treated as a resilience signal, not only an access-management issue. When legitimate credentials can still be chained into lateral movement, the environment is telling you that segmentation, privilege boundaries, and detection logic are not aligned. That is the governance gap practitioners need to close.

Control validation creates a more credible language for executive reporting. Boards and CISOs need evidence that remediation reduces real exposure, not just operational noise. Programmes that cannot connect testing outcomes to risk reduction will struggle to justify investment or prove progress.

For practitioners

• Implement continuous control validation Test whether existing controls stop realistic attack paths in your own environment, then prioritise remediation where validation shows failure rather than where coverage looks thin.
• Validate identity abuse pathways Simulate credential misuse, token replay, and privilege chaining across IAM, PAM, and NHI estates to identify where legitimate access can still be turned into lateral movement.
• Replace tool-count reporting with outcome metrics Report on blocked attack paths, failed privilege escalation attempts, and containment success instead of relying on number of tools, alerts, or patches applied.
• Include AI-assisted infostealing in test plans Add scenarios that reflect automated reconnaissance, content harvesting, and credential theft so validation reflects current attacker speed and scale.

Key takeaways

• SafeBreach’s report argues that resilience should be judged by whether controls stop real attack paths, not by how many tools or alerts a programme has.
• Identity abuse, lateral movement, and AI-driven infostealing remain difficult to catch because they exploit legitimate access and control gaps rather than obvious malware signatures.
• The practical response is to validate identity, privilege, and segmentation controls continuously and to prioritise remediation based on failed attack-path tests.

Key terms

• Callback Validation: Callback validation is the set of checks performed when the federated identity flow returns to the application. It confirms that the response came from the expected flow, belongs to the correct organisation, and can be exchanged safely for a local session. Weak validation creates a direct path from successful authentication to misissued access.
• Attack-path validation: Attack-path validation is the practice of proving whether an attacker can move from one weakness to another until they reach meaningful impact. It goes beyond scanning by testing how exposures connect across identity, network, cloud, and application layers under realistic adversarial conditions.
• Identity Abuse: Identity abuse is the misuse of valid credentials, tokens, delegated permissions, or trusted access relationships to move through an environment. It is dangerous because it often appears legitimate to systems and operators until the attacker has already advanced.
• Exposure Validation: The process of confirming what data actually left the environment, where it came from, and how it could be abused. It is a post-incident governance step that links incident response, data classification, and identity risk assessment.

Deepen your knowledge

NHI Mgmt Group’s NHI Foundation Level course covers NHI governance, machine identity security, and secrets management through an accredited practitioner programme. It helps security leaders connect identity control design to measurable programme outcomes.