Topic starter
25/10/2026 11:07 am
TL;DR: Breaches in 2025 tracked more closely to inconsistent enforcement than to missing tools, according to At-Bay. Remote access, identity checks, logging, and data controls need tighter lifecycle governance so attackers do not find long-lived exceptions to abuse.
Editorial analysis by NHI Mgmt Group, based on content published by At-Bay: “7 Security Actions to Take in 2026 to Exponentially Reduce Your Risk”.
By the numbers:
- 53% of breaches in 2025 started with purchased credentials.
- The average time from credential theft to network compromise is just 3-14 days.
Key questions
A: Stolen credentials stay dangerous because attackers often need only one weak recovery path to impersonate a legitimate user.
Q: How should teams detect whether remote access tools are being used for persistence?
A: By defining what normal remote access looks like first, then flagging tools, hosts, and usage patterns that fall outside that baseline.
Q: What breaks when MFA is not enforced on every remote access path?
A: When MFA is inconsistent, a stolen password can still function as a valid enterprise login, which gives attackers a low-friction entry point into critical systems.
Practitioner guidance
- Enforce leaked-credential response workflows Wire dark web alerts, breach database checks, and forced password resets into a single response path so exposed accounts are treated as compromised immediately.
- Inventory and retire exposed remote access paths Build a complete list of VPN appliances, remote access apps, and administration tools, then remove any software or device you cannot justify for business use.
- Make MFA mandatory on all privileged access Remove exceptions on VPNs, RDP, and cloud admin consoles, and review bypasses monthly so privileged access is always subject to the second factor.
Bottom line: The article's central warning is that attackers exploit inconsistent enforcement more reliably than missing tools.
Glossary terms: Leaked Credentials Data, Remote Access Tool, Data Exfiltration, Implementation Drift
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 days ago by NHI Mgmt Group
27/10/2026 7:16 pm
Control consistency is now the real security variable: the article shows that organisations often have the right tools but fail at enforcement, timing, or coverage. That is a governance problem, not a tooling problem, because attackers only need one inconsistent control boundary to turn a valid identity or exposed edge device into an entry point. Practitioners should measure whether each defence is actually enforced across all environments, not just purchased.
A question worth separating out:
A: Security teams should assume ransomware may be a stealthy extortion operation, not just a disruption event. That means prioritising rapid detection of unusual data access, egress monitoring, backup isolation, and incident response plans that cover disclosure pressure as well as recovery. Controls should be tested against double extortion scenarios, where attackers threaten public release to force payment and avoid the noise of traditional ransomware encryption.
👉 Read our full editorial: Seven security actions that expose the 2026 attack gaps
This post was modified 7 days ago by NHI Mgmt Group