Seven controls that would have changed this quarter’s biggest breaches

At a glance

What this is: This is a control-focused analysis of the quarter's biggest breaches, arguing that the same seven defensive gaps kept appearing across ransomware, supply chain compromise, and identity abuse.

Why it matters: It matters because IAM, PAM, and security teams need to prioritise the controls that change attacker economics, not just expand monitoring after the fact.

Context

The article is about a recurring governance failure: controls are often present in policy, but absent where attackers actually operate, especially across identity, backup, edge infrastructure, and third-party relationships. The primary identity security issue is not one breach pattern but the repeated mismatch between how defenders think access, recovery, and trust work and how attackers exploit them.

For NHI and IAM programmes, the practical lesson is that valid credentials, delegated access, and trusted integrations now sit on the critical path of many breach chains. The article frames that gap through a quarterly breach lens, but the underlying issue is broader than one quarter: periodic controls are losing to faster, credential-led operations.

Key questions

Q: What is the first control teams should fix when valid credentials keep beating perimeter security?

A: Start with phishing-resistant MFA for the access paths attackers most often target: privileged users, remote administrators, and externally exposed services. If authentication can be replayed or proxied, the attacker does not need malware to move forward. The first fix is to remove reusable proof from the login flow before expanding broader detection or response work.

Q: Why do identity-led attacks keep succeeding even when endpoint protection is in place?

A: Endpoint protection is designed to see malicious code, but many modern intrusions use stolen credentials, remote access tools, or built-in utilities that look legitimate at the endpoint layer. Identity telemetry captures the trust boundary the endpoint misses. That is why authentication anomalies and privilege changes often provide the earliest signal of compromise.

Q: What breaks when backup recovery shares the same identity plane as production?

A: Recovery becomes vulnerable to the same credentials and admin paths the attacker used to reach production in the first place. If backup systems and identity services are reachable through the live trust domain, ransomware operators can destroy or lock recovery before encryption finishes. That is a governance failure, not a storage failure.

Q: Should organisations prioritise edge-device monitoring or third-party access reviews first?

A: Both matter, but the first priority should be the paths that combine exposure with authority. Edge devices and supplier platforms deserve immediate focus when they can reach production systems, because they create the shortest route from compromise to impact. Review the paths that can actually change business state.

Technical breakdown

Why phishing-resistant MFA matters when attackers replay valid access

The article argues that traditional MFA methods such as SMS codes and TOTP do not stop device-code phishing, real-time proxy attacks, or other credential replay techniques. Phishing-resistant MFA changes the trust model by binding authentication to a device or cryptographic proof that is harder to relay in real time. In practical terms, the control is less about adding another factor and more about removing reusable secret material from the authentication path. That matters because many compromise paths now end in account takeover rather than malware deployment.

Practical implication: replace replayable MFA with hardware-backed or passkey-based authentication for high-risk users and privileged access paths.

How ITDR closes the blind spot left by endpoint controls

Identity Threat Detection and Response focuses on authentication behaviour, token abuse, impossible travel, privilege escalation, and suspicious use of valid accounts. That differs from endpoint tooling, which is effective against malware but weak against fileless abuse, remote administration tools, and stolen session material. The article's point is that many intrusions no longer need a payload to be malicious. Once an attacker operates through legitimate access channels, identity telemetry becomes the decisive detection layer because the endpoint may look normal while the identity trail is compromised.

Practical implication: correlate identity events, token activity, and privilege changes so compromised access is detected even when no malware is present.

Why immutable backup architecture is now an identity and recovery problem

Ransomware operators increasingly target backup infrastructure, identity services, and virtualisation management planes to deny recovery, not just encrypt data. Immutable backups help only when they are segmented from production trust zones and protected from the same credential paths that attackers use in the live environment. If backup administration depends on the same directory privileges or shared access tokens as production, recovery can be disabled before encryption even begins. The article treats this as a control failure, not a storage problem, because backup trust must be separated from operational identity trust.

Practical implication: isolate backup administration from production identities and validate restores as a separate control, not a paperwork exercise.

Threat narrative

Attacker objective: The attacker aims to turn trusted access into operational control, then deny recovery or scale compromise across connected systems before defenders can react.

1. Entry occurs through phishing-resistant MFA failure, stolen credentials, exploited edge systems, or trusted third-party access that gives attackers a legitimate foothold.
2. Credential abuse and valid account use allow the attacker to move through identity-controlled systems without malware, making detection dependent on behavioural and privilege telemetry.
3. Escalation follows when attackers reach backup, identity, or management planes and disable recovery or expand reach across connected systems.
4. Impact is achieved through ransomware encryption, supply-chain propagation, data compromise, or recovery denial that prolongs outage and increases leverage.

Breaches seen in the wild

• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
• CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Control mismatch, not control absence, is the quarter's defining breach pattern: most organisations already have security tools, but those tools are not aligned to how modern intrusion chains begin and spread. Credential replay, identity abuse, supply-chain trust, and recovery denial all exploit assumptions baked into older defensive models. The practitioner conclusion is that governance must be judged by where controls fail operationally, not by whether they exist on paper.

Phishing-resistant MFA is now a baseline control for valid-access attacks: the article shows that attackers increasingly bypass password theft by using real-time relay and device-code techniques that defeat weaker MFA methods. This is not a matter of factor count but of factor resistance to replay. The implication for identity programmes is that authentication controls must be evaluated by attack resistance, not user friction alone.

Identity Threat Detection and Response belongs alongside endpoint security, not beneath it: when attackers use remote access tools, stolen tokens, or built-in utilities, the endpoint can remain clean while the identity layer is active and malicious. That is why identity telemetry has become a primary detection surface. For practitioners, the decisive question is whether identity signals are correlated fast enough to catch legitimate-account abuse before lateral movement completes.

Backup immutability without identity segregation is only partial protection: the article makes clear that ransomware crews now target backup infrastructure and management planes directly. If the same identity system governs both production and recovery, attackers can remove recovery options before encryption starts. The governance lesson is that restore capability must be treated as a separate trust domain, not a feature of the backup product.

Third-party access governance is now an enterprise exposure multiplier: shared platforms and delegated access create correlated risk, where a weak vendor or platform relationship can amplify impact across many customers. The article's examples show that onboarding controls are not enough if access persists, contracts lack breach obligations, or offboarding is incomplete. Practitioners should treat third-party access as a lifecycle problem, not a procurement artifact.

From our research library:

• Half of 1,100 global security leaders surveyed by CrowdStrike believed they were very well prepared for ransomware, yet 78% of their organisations had been attacked in the past year.

What this signals

Control alignment is now the governing issue: quarterly breach analysis keeps showing that organisations can have tools, policies, and even monitoring in place while still missing the control that matters at the point of attack. The practical shift is from control inventory to control effectiveness, especially where identity and recovery are part of the same failure chain.

Third-party access governance has moved from vendor management to breach prevention: active access paths, shared platforms, and delayed offboarding widen exposure faster than annual reviews can close it. Teams need lifecycle discipline for external access, not just approval records.

Recovery is part of identity architecture now: when attackers target backup planes, identity services, and management systems together, the restore path becomes a security boundary. That means backup immutability only works when the credentials that administer recovery are not governed like ordinary production access.

For practitioners

• Prioritise phishing-resistant MFA for privileged and remote access Replace replayable factors with hardware-backed or passkey-based authentication first for admins, support staff, and internet-facing remote access paths.
• Add identity telemetry to detection engineering Correlate authentications, token use, privilege changes, and remote administration activity so valid-account abuse is visible before lateral movement expands.
• Separate backup administration from production identities Remove shared directory dependencies, restrict backup-plane credentials, and test restore capability through a distinct recovery trust path.
• Inventory and continuously review third-party access paths Track which vendors, platforms, and shared services still hold active access, then revalidate offboarding, breach notification duties, and privilege scope.
• Scan internet-facing assets continuously against exploitation activity Tie exposed systems to active exploitation intelligence so patch sequencing follows real adversary use rather than routine calendar cycles.

Key takeaways

• The quarter's breach pattern was not random. It exposed repeatable control failures across authentication, identity detection, recovery, third-party access, and edge exposure.
• The evidence points to a faster attack tempo, with valid credential abuse and recovery denial reducing the time defenders have to respond.
• The most effective response is to align controls to attacker behaviour, starting with phishing-resistant MFA, identity telemetry, and isolated recovery trust paths.

Key terms

• Phishing-Resistant MFA: Phishing-resistant MFA uses authentication factors that cannot be easily replayed, intercepted, or socially engineered. In regulated environments, this usually means device-bound or cryptographic methods rather than push prompts or SMS codes, because the control must hold up under realistic attack conditions.
• Identity Threat Detection and Response: Identity threat detection and response is the practice of finding misuse of credentials, unusual access patterns, and compromised identities across human and machine actors. For NHIs, it relies on telemetry from code, vaults, cloud services, and pipelines to detect abuse early enough to contain it.
• Immutable Backup: An immutable backup is a copy that cannot be altered or deleted during its retention period. It protects recovery points from ransomware and accidental deletion, but it only delivers value when the organisation can restore from it successfully during an incident.
• Third-Party Access Governance: Third-party access governance is the control set that tracks, approves, reviews, and revokes access granted to external vendors and partners. It becomes an identity problem when suppliers operate through shared credentials, delegated workflows, or persistent machine access that outlives the business need.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.