Topic starter
01/08/2026 8:53 pm
TL;DR: Identity abuse, session theft, and supply-chain compromise converged into one application risk pattern in Veracode’s July 2026 briefing, according to Veracode. AppSec teams need exposure context to rank reachable paths, stolen tokens, and delivery-chain abuse before low-value flaws.
Editorial analysis by NHI Mgmt Group, based on content published by Veracode: “CISO Executive Briefing: Application Risk Intelligence for July 2026”.
By the numbers:
- The top 10 ransomware groups account for approximately 71% of claimed victims.
Key questions
Q: Why do post-MFA sessions and tokens still create ransomware risk?
A: Because MFA only proves the login event, not the security of what remains after login.
Q: What breaks when application risk scoring ignores identity exposure?
A: Prioritisation becomes detached from exploitability.
Q: How should security teams govern credentials used by CI/CD pipelines?
A: Security teams should treat CI/CD credentials as production-grade machine identities and apply least privilege, short lifetimes, and continuous monitoring.
Practitioner guidance
- Inventory CI/CD and registry identities Map every maintainer account, OAuth grant, pipeline token, and build-service identity that can publish or promote software, then classify them by privilege and business criticality.
- Block malicious packages before ingestion Apply preventive package controls to repositories and developer workflows so newly published, typosquatted, or policy-violating packages are stopped before they reach runners or workstations.
- Tighten post-authentication session controls Focus on token revocation, delegated access review, and session-binding checks for workflows where MFA has already succeeded but access remains live.
Bottom line: Application risk intelligence now depends on how quickly attackers can turn trusted software delivery and identity paths into working access.
Glossary terms: Device Risk Intelligence, Exposure-to-execution gap, Post-Authentication Abuse, Supply-Chain Ingress
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 54 minutes ago by NHI Mgmt Group
01/08/2026 9:02 pm
Supply-chain risk has become an identity governance problem, not just a code-integrity problem. When attackers target registries, CI/CD credentials, and maintainer accounts, the control boundary shifts from package scanning to identity lifecycle management. That means the governance issue is ownership, scope, and revocation of the identities that can publish, approve, or deploy software. Practitioners should treat software delivery access as privileged identity infrastructure.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should organisations respond when AI agents and code assistants touch delivery pipelines?
A: They should govern them as non-human identities with explicit policy boundaries, not as convenience tooling. That means tracking what credentials they can request, what repositories they can reach, and what approvals they can trigger. The practical aim is to stop machine-speed workflows from bypassing the same controls human developers must satisfy.
👉 Read our full editorial: Application risk intelligence now hinges on identity and supply chain