TL;DR: Unosecur says its Wiz Integrations Network partnership is designed to combine cloud visibility with runtime identity context so teams can prioritise risky human and non-human identities, compress attacker dwell time, and improve evidence collection across hybrid estates. Runtime identity control, not post-incident visibility, becomes the operational pivot.
At a glance
What this is: Unosecur’s WIN integration with Wiz pairs cloud risk visibility with runtime identity context to help teams prioritise risky human and non-human identities and act faster.
Why it matters: IAM, IGA, PAM, and NHI teams should read this as a signal that identity response is shifting toward runtime evidence, prioritisation, and least-privilege enforcement across hybrid estates.
Context
Unosecur’s announcement is about integrating cloud risk visibility with runtime identity controls across hybrid estates. The core problem is not a lack of security findings, but the difficulty of turning those findings into identity-specific action fast enough to reduce exposure.
The article frames that issue through human and non-human identities, including compromised sessions, malicious browser plugins, supply-chain compromise of non-human identities, and social engineering. In that context, the value proposition is operational: prioritise what matters, reduce blast radius, and preserve evidence before the environment changes again.
Key questions
Q: What breaks when cloud findings are not enriched with identity and vulnerability context?
A: Without enrichment, teams see disconnected alerts instead of a path to risk reduction. Cloud posture issues, vulnerable packages, and identity relationships can be missed as part of the same attack path, which makes prioritisation harder and remediation slower. Enrichment with severity, exploitability, and known threat data helps teams separate noise from issues that can actually drive compromise.
Q: Why do human and non-human identities need different runtime controls?
A: Because the compromise paths differ even when the impact looks similar. Human identities are more often exposed through sessions and social engineering, while non-human identities are more often exposed through dependency abuse, stale credentials, or overprivilege. Runtime controls must reflect those differences.
Q: How do security teams know whether just-in-time credential access is actually reducing risk?
A: Just-in-time access is working when privileged credentials are short-lived, task-scoped, and automatically retired after use. Good signals include fewer standing secrets, fewer shared accounts, faster revocation, clearer audit trails, and less manual password handling by people or pipelines. If access persists beyond the task, the control is not delivering its intended risk reduction.
Q: What should identity teams do when cloud risk and identity risk are both present?
A: Treat the cloud finding as a trigger for identity containment, not as a separate queue. The response should identify which human or non-human identity can be constrained first, which evidence must be preserved, and which access paths must be closed before the attacker can reuse them.
Technical breakdown
Runtime identity context turns cloud findings into action
The technical problem here is correlation, not collection. Cloud security platforms can surface inventory, misconfiguration, and vulnerability findings, but identity teams still need runtime context to decide which user, service account, token, or workload identity should be constrained first. A runtime identity fabric ties those findings to active sessions, privilege scope, and trust relationships across cloud, SaaS, and on-prem systems. That matters because identity risk is only useful when it is actionable at the moment of exposure, not after the fact.
Practical implication: connect cloud findings to live identity state before you triage, not after the incident window has closed.
Just-in-time controls compress attacker dwell time
Just-in-time access changes the timing model of privilege. Instead of assuming entitlements remain static long enough to be reviewed later, JIT grants access only when a task is active and removes it when the task ends. In a hybrid estate, that reduces the chance that a compromised session, stolen credential, or abused service identity can keep using the same privilege set across systems. The runtime benefit is not only smaller blast radius, but fewer durable artefacts for an attacker to reuse.
Practical implication: reserve standing privilege for the smallest set of recovery and administrative paths, and push everything else toward task-scoped access.
Identity timelines strengthen evidence collection after compromise
Identity timelines are a forensic layer, not just a reporting feature. They reconstruct who or what had access, when privileges changed, and which actions occurred during the compromise window. That is especially useful when human and non-human identities are both involved, because the path from initial access to secondary movement often crosses multiple identity types and control domains. Without that timeline, teams end up with fragmented logs that are hard to align to a coherent sequence of events.
Practical implication: preserve identity timelines as part of your incident-ready evidence model so investigation starts with sequence, not guesswork.
Threat narrative
Attacker objective: The attacker seeks durable identity-driven access that can be used to move, persist, and operate across cloud and hybrid environments before defenders can constrain it.
- Entry often starts with a compromised user session, a malicious browser plugin, or a supply-chain compromise of source code dependencies and packages, all of which can hand an attacker an initial trusted foothold.
- Escalation follows when the attacker uses that foothold to reach higher-value human or non-human identities with more privilege than the original session should have had.
- Impact occurs when standing access, poor blast-radius control, or slow investigation lets the attacker move further, fix persistence, and extract value before defenders can contain the activity.
Breaches seen in the wild
- Storm-2949 Azure Breach: Storm-2949 social engineering attack turns one cloud identity compromise into full Azure tenant breach.
- reviewdog Action compromise 2025: A stolen maintainer token poisoned reviewdog/action-setup, leaking CI secrets including the tj-actions bot token used in the next attack.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Runtime identity security is becoming the control plane that turns cloud visibility into identity action. Visibility alone does not stop privilege misuse when the question is which identity should be constrained first, for how long, and at what blast radius. The WIN model reflects a broader market shift from inventory-centric cloud security to identity-centric response, where the decisive control is the ability to act at runtime. Practitioners should treat this as a signal to align cloud findings with live identity governance.
Human and non-human identities now share the same operational risk surface, but not the same failure modes. A compromised browser session and a compromised service identity may end in similar impact, yet the governance failure is different in each case. Human risk often hinges on session compromise and social engineering, while non-human risk more often involves supply chain exposure, overprivilege, or stale credentials. Security programmes that separate these domains too rigidly will miss the shared runtime choke points.
Ephemeral privilege only reduces risk when evidence and enforcement move at the same speed as access. The promise of just-in-time controls is not just less standing access, but a tighter loop between detection, decision, and revocation. That loop is what makes blast-radius reduction measurable rather than theoretical. For identity teams, the takeaway is to measure control latency as carefully as access breadth.
Blast-radius control is now a first-class identity objective, not a side effect of monitoring. The article’s emphasis on reducing attack surface, limiting insider-threat exposure, and improving investigation speed shows where practitioner priorities are heading. Organisations will increasingly be judged on how quickly they can convert cloud findings into identity containment. The practical conclusion is to design identity governance around runtime containment, not periodic review alone.
What this signals
Runtime identity control is becoming the missing layer between cloud detection and containment. For many programmes, the hard part is not seeing risk but deciding which identity to shut down first without losing investigative context. That makes identity timelines and blast-radius thinking more operationally important than another round of static inventory.
Hybrid estates force practitioners to govern human and non-human identities through the same response loop. The controls differ, but the containment problem is shared: live privilege, session state, and evidence must be treated as one sequence. Teams that keep cloud security and identity governance separate will move too slowly when the next alert arrives.
For practitioners
- Prioritise identity findings by runtime blast radius Map cloud security findings to the identities that can actually be used next, then rank the highest-risk human and non-human identities for immediate containment.
- Pair JIT controls with live session evidence Use just-in-time access only where you can also capture the session, privilege change, and identity timeline needed to investigate later.
- Separate human compromise from non-human exposure paths Track compromised sessions, social engineering, and browser-based attacks separately from dependency and package compromise so the right control owners respond.
- Reduce standing privilege in hybrid workflows Limit persistent access across cloud, SaaS, and on-prem environments so a single identity compromise cannot carry the same reach across every control plane.
Key takeaways
- The article shows that runtime identity context is now central to turning cloud findings into actionable containment decisions.
- It also reflects a broader shift toward limiting blast radius and preserving identity evidence across both human and non-human identities.
- Practitioners should focus on live privilege, just-in-time controls, and identity timelines rather than relying on post-incident review alone.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | The article focuses on reducing runtime attack surface for human and non-human identities. |
| NHI-07 — Long-Lived Secrets | Runtime containment and identity timelines are meant to limit durable credential exposure. | |
| Recommendation — Reduce standing privilege and constrain high-risk identities to the smallest viable runtime scope. Shorten credential exposure windows and revoke identity access once the task is complete. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | The announcement centers on runtime control of identity credentials and their lifecycle. |
| Recommendation — Apply IA-5 to govern credential issuance, use, and revocation across cloud and hybrid estates. | ||
| MITRE ATT&CK | TA0006; TA0008 — Credential Access; Lateral Movement | The threat model described includes session compromise and movement across identities. |
| Recommendation — Map compromised sessions and identity reuse to TA0006 and TA0008 when prioritising containment. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Runtime identity control is fundamentally about governing active entitlements and authorisations. |
| Recommendation — Continuously validate entitlements and remove access that no longer matches current risk. | ||
Key terms
- Runtime Identity: Runtime identity is the practice of making identity and authorization decisions at the moment an action occurs. For agents and workloads, it means access is validated against live context, not only against the identity state set during onboarding or provisioning. That makes accountability and scope enforcement possible inside fast-moving workflows.
- Identity timeline: An identity timeline is an ordered record of identity actions, privilege changes, and resource access over time. It helps investigators reconstruct how an attack unfolded and helps governance teams prove whether controls worked. When accurate, it turns evidence into a security and audit asset.
- Blast Radius: The potential scope of damage if a specific credential or identity is compromised. Identities with broad permissions have a larger blast radius and represent a higher priority for least-privilege enforcement and security controls.
- Just-in-Time Access Request: Just-in-Time Access Request is a pattern that grants access only when it is needed and only for the duration required. It reduces standing privilege by making access temporary, policy driven, and task scoped. This approach is especially useful for contractors, sensitive systems, and short-lived operational work.
What's in the full analysis
Unosecur's full announcement covers the operational detail this post intentionally leaves for the source:
- How the WIN integration shares prioritized security findings with context across cloud and identity workflows
- How the identity timeline supports investigation after a compromised session or non-human identity event
- How no-code workflows and bulk remediation are positioned for runtime containment
- How the platform maps identity-centric compliance reporting to SOC 2, PCI DSS 4.0, and ISO 27001
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 23, 2026.
Updated on October 7, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org