Seven controls that would have changed this quarter’s biggest breaches

At a glance

What this is: This is a quarterly breach analysis showing that seven specific controls would have materially changed recent ransomware, supply-chain, and identity-abuse outcomes.

Why it matters: It matters because IAM, PAM, NHI governance, and detection teams are all being asked to close gaps that attackers now exploit in minutes, not days.

By the numbers:

• July 2026 recorded 799 confirmed ransomware attacks, a 19% month-on-month increase.
• 2026 adversary tracking report puts average eCrime breakout, ut time at 29 minutes.
• In 2025, 67% of organizations experienced at least one successful account takeover.
• The average organization runs 10 AI applications per month, many outside formal approval processes.

👉 Read Anomali's analysis of the seven controls that could have changed Q3 breaches

Context

The central security problem is control mismatch. Recent breach patterns show attackers moving faster than periodic patch cycles, relying on valid credentials, supply-chain trust, and recovery denial rather than noisy malware alone. For identity practitioners, that means the old assumption that perimeter controls and endpoint tools will catch the majority of incidents is no longer defensible.

The article is primarily about the gap between threat tempo and enterprise control maturity. It connects ransomware, third-party access, cloud identity abuse, and shadow AI into one operational picture: defenders need controls that interrupt entry, limit privilege, preserve recovery, and detect identity abuse in real time.

For NHI and IAM programmes, the relevant lesson is that identity is now part of both the attack surface and the recovery surface. Service accounts, tokens, third-party access paths, and AI credentials all sit inside the same failure pattern when governance is fragmented or reviewed too slowly.

Key questions

Q: What breaks when phishing-resistant MFA is not in place for regulated systems?

A: When phishing-resistant MFA is missing, a single phishing message can expose authenticated access paths that regulators expect to be stronger. In NYDFS environments, that weak link can convert an email compromise into a compliance failure because the control is meant to reduce credential replay and prove access assurance on sensitive systems.

Q: Why do valid-account attacks and token abuse matter more than malware in many breaches?

A: Because many modern intrusions do not need malicious files to execute. They rely on stolen credentials, compromised tokens, or built-in remote tools that look legitimate to endpoint security. That shifts the defensive burden to identity telemetry, privilege monitoring, and session behaviour analysis rather than malware signatures alone.

Q: What are the signs that a third-party access breach is in progress?

A: Common warning signs include logins from suspicious IP addresses, repeated 401 and 403 responses, abnormal authentication patterns in vendor logs, and outbound connections to known malicious domains. Security teams should correlate these signals with access history and data movement. A single anomaly may be noise, but several together often indicate credential abuse or active exfiltration.

Q: How should teams respond when ransomware targets backups and identity systems together?

A: Treat recovery as part of the attack surface and validate that backup administration is separated from production access. If the same credentials can reach both planes, an attacker can deny recovery before encryption even starts. Restore testing and identity segmentation need to be designed together, not as separate programmes.

Technical breakdown

Why phishing-resistant MFA beats OTPs and SMS for account takeover

Phishing-resistant MFA changes the trust model by binding authentication to the legitimate device and origin, not just to a shared code or push challenge. OTP-based methods can still be relayed in real time through proxy attacks, device code phishing, or prompt bombing. In practice, that means an attacker can satisfy the second factor while never controlling the user’s device. The article’s point is not that MFA is ineffective, but that the wrong MFA leaves the identity layer vulnerable to modern credential theft workflows.

Practical implication: Prioritise passkeys or hardware-backed MFA for privileged and high-risk accounts before tightening lower-value control layers.

How identity threat detection and response finds malware-free intrusion

Identity threat detection and response looks for abuse of legitimate identities, not malware signatures. It monitors signals such as impossible travel, token replay, anomalous privilege changes, and suspicious authentication sequences across directory, cloud, and SaaS systems. This matters because many modern intrusions use built-in tools, remote management software, or stolen tokens that appear valid to endpoint security. The control therefore shifts detection from the device to the identity substrate, where the abuse actually occurs.

Practical implication: Correlate authentication, token, and privilege telemetry so valid-account abuse becomes visible before lateral movement completes.

Why immutable backups must be isolated from the production identity plane

Immutable backups only help if attackers cannot also reach the recovery system through the same identity trust chain that protects production. Modern ransomware groups increasingly target backup administration, identity services, and virtualization management first, then encrypt production data after disabling recovery. A backup that is reachable with the same credentials, the same domain trust, or the same admin plane is not meaningfully separated. The security value comes from isolation, immutability, and tested restorability together, not from storage alone.

Practical implication: Separate backup administration from production identities and test restores under attack conditions, not just on a schedule.

Threat narrative

Attacker objective: The attacker objective is to convert fast identity access into durable operational disruption, data theft, or recovery denial before defenders can respond.

1. Entry begins with phishing-resistant MFA bypass opportunities, exposed credentials, third-party trust exposure, or unpatched internet-facing systems that attackers can exploit quickly.
2. Escalation follows when valid credentials, token abuse, or backup administration access lets the attacker move from initial entry into identity, cloud, or recovery systems.
3. Impact occurs when the attacker disables recovery, exfiltrates data, or encrypts production systems after defenders fail to detect identity abuse in time.

Breaches seen in the wild

• Shai Hulud npm malware campaign — Shai Hulud campaign: npm malware exposed secrets on GitHub.
• Reviewdog GitHub Action supply chain attack — reviewdog/action-setup GitHub Action supply chain attack exposed secrets.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity control failure is now an execution-speed problem, not just a hygiene problem. The article’s breach set shows that periodic review and reactive patching are being outrun by attacker tempo. When breakout time is measured in minutes, controls that depend on next-cycle remediation are already late. Practitioners should treat identity, backup, and exposure management as continuous runtime controls, not quarterly clean-up tasks.

Phishing-resistant MFA is really a trust-boundary control, not an authentication preference. The evidence in this piece shows that OTP and SMS factors can still be satisfied during live relay attacks, which means the control does not reliably distinguish the legitimate user from the attacker. That failure is structural, not cosmetic. IAM teams should read this as a boundary problem: if the factor can be proxied, it cannot anchor high-risk access decisions.

Third-party access governance is a lifecycle problem that becomes a breach problem when offboarding is weak. The NAIC and PayPal references point to the same pattern: access is reviewed at onboarding, then left to drift. Standing access, misclassification, and unmonitored vendor pathways create the conditions for correlated compromise across shared platforms. Practitioners should view third-party accounts and shared service access as lifecycle objects that require continuous ownership, not contract-only control.

Recovery is part of identity governance once ransomware operators target backup infrastructure and identity services directly. That is the real governance shift in this quarter’s breach set. The backup plane, virtualization plane, and identity plane now share the same blast radius if they are administered through common credentials or flat trust. Practitioners should reframe resilience as access segmentation plus recovery integrity, not as storage durability alone.

Shadow AI expands the NHI problem into an unapproved credential estate. The article’s AI application and prompt-governance discussion shows that AI services, API keys, and exposed .env files are now part of the same identity risk picture as traditional service accounts. AI credential sprawl: once AI tools and their secrets sit outside formal approval, they behave like unmanaged NHIs with data-exfiltration potential. Identity teams should treat AI inventory as a governance input, not a separate innovation programme.

From our research:

• 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, according to The 2024 ESG Report: Managing Non-Human Identities.
• The average organisation believes more than 1 in 5 of their non-human identities are insufficiently secured, which matches the governance drift described in this quarter's breach set.
• That pattern is why practitioners should pair lifecycle visibility with The 52 NHI breaches Report when building a remediation roadmap.

What this signals

Identity programme leaders should read this quarter as a sequencing warning. The next improvement cycle should not start with broad platform consolidation. It should start with the controls that interrupt the fastest attack paths: phishing-resistant authentication, identity telemetry, and separated recovery access. If those three are weak, every other control inherits avoidable blast radius.

Recovery architecture now belongs in the identity roadmap. The article makes clear that backup systems are no longer passive assets. They are governed access paths that attackers actively target through the same credential and privilege mechanisms used elsewhere. Teams that still manage recovery as storage hygiene rather than identity risk will keep discovering the gap after the incident.

AI application sprawl turns into NHI sprawl the moment a tool gets a credential. That means security teams need one governance view across human identities, machine identities, and AI-linked secrets. With the 2024 ESG Report: Managing Non-Human Identities showing a breach or suspected breach in 72% of organisations, the case for unified lifecycle control is no longer theoretical.

For practitioners

• Prioritise phishing-resistant MFA for privileged access Move high-risk users and administrators onto passkeys or hardware-backed authenticators first, especially where the account can reach cloud, directory, or backup systems. The key test is whether the factor can still be relayed through a proxy attack.
• Separate backup administration from production identity paths Use distinct admin accounts, isolated recovery credentials, and restore tests that prove recovery still works when production identities are unavailable. This reduces the chance that ransomware can disable both production and recovery with one credential set.
• Instrument identity telemetry for token and privilege abuse Feed authentication events, token issuance, privilege changes, and anomalous login patterns into detection workflows so valid-account abuse is visible. Identity threat detection and response needs cross-domain correlation, not just endpoint alerts.
• Review third-party accounts as lifecycle objects Track onboarding, scope, monitoring, renewal, and offboarding for every vendor or shared-platform account, including active tokens and service access. Access that is not explicitly retired should be treated as still live.
• Inventory AI applications and their secrets Map approved and unapproved AI tools, then identify any API keys, .env files, or service tokens tied to those workflows. Shadow AI becomes an identity problem as soon as the tool can access company data or credentials.

Key takeaways

• The article shows that breach prevention now depends on controls that can keep pace with attacker speed, not only on periodic hardening.
• Identity abuse, third-party drift, and recovery denial are the recurring failure modes, which means IAM and resilience teams are now dealing with the same attack surface.
• Organizations should treat phishing-resistant MFA, identity telemetry, and isolated recovery as the first three controls to mature because they change the outcome of the fastest breaches.

Key terms

• Phishing-Resistant MFA: Phishing-resistant MFA uses authentication factors that cannot be easily replayed, intercepted, or socially engineered. In regulated environments, this usually means device-bound or cryptographic methods rather than push prompts or SMS codes, because the control must hold up under realistic attack conditions.
• Identity Threat Detection and Response: Identity threat detection and response is the practice of finding misuse of credentials, unusual access patterns, and compromised identities across human and machine actors. For NHIs, it relies on telemetry from code, vaults, cloud services, and pipelines to detect abuse early enough to contain it.
• Backup Immutability: Backup immutability means stored backup data cannot be changed, overwritten, or deleted for a defined period. In identity recovery, this protects restore points from tampering during ransomware, insider abuse, or operational error. It is a core control for preserving integrity when backups become the last trustworthy copy of the environment.
• Third-Party Access Governance: Third-party access governance is the control set that tracks, approves, reviews, and revokes access granted to external vendors and partners. It becomes an identity problem when suppliers operate through shared credentials, delegated workflows, or persistent machine access that outlives the business need.

What's in the full article

Anomali's full analysis covers the operational detail this post intentionally leaves for the source:

• Per-control breach examples showing how each failure mode changed the outcome of recent incidents.
• The source references behind the July ransomware spike, identity abuse trends, and supply-chain compromise patterns.
• Practical context for why each control belongs in a live detection, response, or resilience programme.
• The full references section for the incident and threat reports cited in the article.

👉 Anomali's full post covers the evidence trail, control rationale, and cited breach examples in detail.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.