Topic starter
11/07/2026 2:00 pm
TL;DR: Ransomware incidents such as St. Paul’s 2025 shutdown show that cyberattacks now create operational, public safety, and continuity impacts, according to Illumio. The practical shift for 2026 is that containment, segmentation, and accountability matter more than assuming prevention will hold.
Editorial analysis by NHI Mgmt Group, based on content published by Illumio: “Cybersecurity Predictions 2026: Expert Insights on the Trends Shaping the Year Ahead”.
Key questions
Q: What fails when organisations rely on prevention instead of containment?
A: Prevention-only strategies fail when an attacker gets past the first control, because broad connectivity and standing privilege let the incident spread faster than defenders can respond.
Q: Why do service accounts and AI agents need different controls from human users?
A: Service accounts and AI agents authenticate and act without the predictable patterns that human identity systems expect.
Q: What are the signs that Zero Trust is not actually containing incidents?
A: Common signs include lateral movement across supposedly separate zones, service accounts reaching systems they should not touch, and incidents that force broad shutdowns instead of local isolation.
Practitioner guidance
- Build for containment first Map critical systems to the smallest practical trust zones and verify that a compromise in one zone cannot reach core services unchecked.
- Inventory non-human access paths Catalogue service accounts, tokens, and AI agent credentials that can initiate actions across applications and APIs, then assign clear owners and revocation processes.
- Test operational continuity under attack Run scenario exercises that assume ransomware, supplier compromise, or identity abuse has already occurred and measure how quickly critical services can be isolated.
Bottom line: Cyber resilience is shifting from a secondary security goal to the baseline that determines whether organisations can keep operating during an attack.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 2:11 pm
Cyber resilience is now an identity governance problem, not only a security architecture problem. When organisations ask what happens after a breach, the answer is often determined by who or what had standing access in the first place. Excessive privilege, weak segmentation, and unmanaged non-human identities turn a contained event into an operational outage. Practitioners should treat blast radius as a governance metric, not just a technical outcome.
A question worth separating out:
Q: How should boards hold security teams accountable for resilience?
A: Boards should ask for evidence of containment, recovery, and service continuity, not just prevention metrics or compliance status. That means tracking how much business impact a cyber incident can create, who owns the control failures, and whether identity, network, and operational teams share responsibility for reducing exposure.
👉 Read our full editorial: Cyber resilience is becoming the baseline for 2026 planning