TL;DR: Security visibility now determines whether defenders can understand attack paths across identity, network, application, and cloud layers before an adversary moves laterally, according to Illumio's Black Hat 2025 conversation with CyberWire's Bennett Moe and Cloud Security Alliance CEO Jim Reavis. The strategic shift is clear: if your map is incomplete, AI makes the gap more dangerous, not less.
At a glance
What this is: This piece argues that cybersecurity visibility has become the decisive advantage in cyber resilience because layered maps of identity, network, application and cloud relationships reveal attack paths before attackers can traverse them.
Why it matters: IAM and cloud teams need this lens because incomplete relationship maps leave standing access, dependency chains and routing decisions invisible, which weakens both prevention and containment.
Context
Visibility in security is the ability to see how identities, workloads, applications and cloud dependencies connect in practice, not just whether they exist in inventory. The governance gap is that many teams still manage these layers separately, so attack paths only become obvious after movement has already started. In identity-heavy environments, that means the map of who can reach what is often less complete than teams assume.
The article frames layered mapping as a resilience problem, not just an observability problem. That matters because cloud scale, AI-assisted attacker speed and third-party dependency chains can turn small blind spots into broad exposure, especially where identity and access relationships are not continuously reconciled.
Key questions
Q: Why do compliance reviews fail to predict breach risk in cloud and identity environments?
A: Compliance reviews often prove that a control was documented at a point in time, not that it stayed effective. In cloud and identity environments, settings drift, privileged accounts change, and third-party access paths remain active after the review ends. Breach risk comes from the live state, so technical verification matters more than self-attestation.
A: Security teams should centralise telemetry from existing tools into one view and map relationships between assets, identities, and controls. That approach helps expose dependencies and attack paths that isolated tools miss. The goal is not more alerts, but clearer context. When visibility extends beyond the obvious attack surface, teams can spot weak links before they become exploitable gaps.
Q: What are the signs that cloud dependency tracking is failing?
A: Frequent 'what changed?' investigations, manual reconstruction during incidents, inconsistent postmortem findings, and uncertainty about route, access, or service dependencies all indicate that relationship history is missing or incomplete.
A: Whenever dependency chains can affect business continuity, security containment or recovery decisions. If a hidden route, provider dependency or identity relationship could let an attacker move laterally or disrupt a service, visibility has become part of resilience governance and should be managed that way.
Technical breakdown
Why layered relationship maps matter for attack-path analysis
A security map is an abstraction of the environment that keeps only the relationships needed for a decision. In practice, that means overlaying identity, network and application dependency data so defenders can see how one compromise can traverse multiple layers. A stolen credential may not be the end state, but it often becomes the entry point into a broader path that includes lateral movement and access to critical workloads. The technical value is not raw telemetry volume. It is the ability to resolve which relationships change the risk picture before an attacker does.
Practical implication: build correlated identity, network and application views so attack-path analysis is possible before movement occurs.
How AI changes the pace of visibility and misuse
AI changes both sides of the equation because it accelerates analysis for defenders and reconnaissance for attackers. That makes outdated maps more dangerous: a misconfiguration or dependency gap that once took days to exploit may now be actionable in minutes. The underlying issue is not AI itself but the speed with which AI can surface weak control points and chain them together. In a cloud and identity environment, that compresses the time available to detect, decide and contain.
Practical implication: treat stale relationship data as an exposure, because AI shortens the time between blind spot and exploitation.
Why cloud dependency mapping is now a resilience control
Cloud dependency mapping goes beyond knowing what is deployed. It asks which workloads depend on which providers, APIs and failover paths, and what happens when one link fails. That matters because service interdependence creates systemic risk, especially when critical functions rely on third parties or have no operational fallback. The governance lesson is that resilience depends on knowing dependencies and dependencies of dependencies, not just on inventory completeness.
Practical implication: maintain dependency maps that include third-party services and failover assumptions, not only primary assets.
Threat narrative
Attacker objective: The attacker aims to exploit unseen relationships in identity and cloud infrastructure to reach critical assets faster than defenders can respond.
- Entry begins when an attacker obtains a credential or finds a misconfiguration that exposes a reachable path in the environment.
- Credential use or misuse lets the attacker traverse identity, network and application relationships that defenders have not fully mapped.
- Escalation occurs as the attacker moves laterally toward higher-value workloads or cloud dependencies that were hidden by incomplete visibility.
- Impact is reached when the attacker can access critical services or disrupt resilience assumptions before defenders can contain the path.
Breaches seen in the wild
- Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
- CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Visibility mapping is now a governance control, not just an operations aid. The article shows that teams cannot govern access they cannot see in relation to other systems, which is especially true where identity, network and application layers are managed in separate tools. That makes relationship mapping a prerequisite for both IAM and cloud resilience. Practitioners should treat incomplete visibility as a control gap, not a reporting inconvenience.
Identity relationship maps expose the real blast radius of access. A list of accounts tells you who exists, but a relationship map tells you what those accounts can actually reach across services and dependencies. That is the difference between nominal access review and usable attack-path analysis. For identity teams, the practical conclusion is that entitlement data must be evaluated in context, or privilege scope remains misunderstood.
AI compresses the window between blind spot and breach. The article’s key warning is that faster attacker navigation makes weak visibility more consequential, not less. If your maps are stale, automation helps adversaries exploit the gap before humans can reconcile it. The field should interpret this as a demand for continuously refreshed control data and faster correlation across domains.
Cloud dependency sprawl is becoming a resilience liability. When critical services rely on third-party APIs, regional assumptions or opaque failover paths, outage and compromise risk become interlinked. That is why dependency mapping belongs inside resilience planning, not only architecture documentation. Practitioners should use it to identify where a single upstream failure can cascade into operational disruption.
AI literacy is now part of security leadership accountability. The article makes clear that understanding AI risk is not only for model builders, because AI changes attacker speed, defender speed and decision quality at the same time. Security leaders need enough technical fluency to judge where AI helps and where it magnifies control gaps. Practitioners should elevate AI-informed visibility into governance conversations, not leave it as a tooling discussion.
From our research library:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- Read next: Role Mining and Role Design Guide
What this signals
Relationship mapping is becoming a governance requirement for modern resilience. Security teams can no longer rely on separate inventories for identity, cloud and application layers when attackers can chain them together faster than reviewers can reconcile them. The practical shift is to treat connected visibility as part of control design, not an after-the-fact dashboard.
Identity teams should expect the blast-radius question to dominate access governance. If a map cannot show what an identity can reach, the organisation cannot credibly judge whether privilege is narrow, excessive or business-critical. That makes entitlement context, not entitlement count, the more useful measure of risk.
Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs. That gap explains why cloud and identity leaders should assume their maps are incomplete until proven otherwise, especially where service accounts connect directly to critical workloads.
For practitioners
- Integrate identity, network and application maps Correlate identity relationships with network and service dependency data so analysts can trace plausible attack paths across layers instead of reviewing each domain in isolation.
- Refresh cloud dependency inventories continuously Track provider regions, third-party APIs and fallback routes as living operational dependencies, not static architecture diagrams.
- Use AI to accelerate correlation, not assumptions Apply automation to surface relationship changes and prioritise alerts, but validate the underlying access and dependency data before making containment decisions.
- Prioritise context-rich access reviews Review entitlements together with reachable systems and service dependencies so the team can see the actual blast radius of access.
Key takeaways
- Security visibility now functions as a resilience control because it shows how identity, network, application and cloud relationships can be chained by an attacker.
- The central weakness is not lack of telemetry, but lack of connected context across the layers that define real attack paths.
- Teams that keep their dependency maps current can reduce lateral movement risk and make containment decisions faster.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0 and CSA Cloud Controls Matrix set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | TA0006; TA0008 — Credential Access; Lateral Movement | The article centres on stolen credentials and lateral traversal across mapped layers. |
| Recommendation — Map identity-driven movement to TA0006 and TA0008 to prioritise pathways attackers can actually traverse. | ||
| NIST CSF 2.0 | DE.CM-01 — Networks and environments are monitored to detect potential cybersecurity events | Layered visibility is the core monitoring problem discussed in the article. |
| PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article highlights how identity maps reveal what access can actually reach. | |
| Recommendation — Use DE.CM-01 to keep connected monitoring on identity, cloud and application relationships current. Apply PR.AA-05 to verify entitlements in the context of reachable systems and service dependencies. | ||
| CSA Cloud Controls Matrix | IAM — Identity and Access Management | Cloud identity relationships and dependency mapping are central to the article's resilience thesis. |
| Recommendation — Use IAM controls in the CCM to maintain a current view of identities, roles and cross-service access. | ||
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | The article's identity angle focuses on exposed access paths and the blast radius of credentials. |
| Recommendation — Review non-human access against NHI-05 to reduce hidden reach across cloud and application layers. | ||
Key terms
- Security Visibility: Security visibility is the ability to see what software, identities, dependencies, and behaviours exist across an environment well enough to make informed decisions. It includes knowing what code is being generated, what tools are in the stack, and where trust assumptions can fail before they become incidents.
- Attack path: A sequence of identities, permissions, systems, and data stores that an attacker can traverse after obtaining trusted access. In practice, attack paths matter more than single accounts because they show how a low-risk identity can become a route to high-value exposure.
- Cloud Dependency Mapping: The process of documenting which cloud services, APIs, regions, and external providers a workload depends on. It helps teams understand not just primary dependencies but also hidden trust chains that can turn an outage or compromise into a wider operational event.
- Blast Radius: The potential scope of damage if a specific credential or identity is compromised. Identities with broad permissions have a larger blast radius and represent a higher priority for least-privilege enforcement and security controls.
Deepen your knowledge
NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity and secrets management in a way that helps practitioners connect identity control to broader security operations. It is suitable for security and identity teams that need a stronger governance lens on machine access and credential risk.
Published by the NHIMG editorial team on July 12, 2026.
Updated on October 13, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org