Topic starter
12/07/2026 12:26 pm
TL;DR: Security visibility now determines whether defenders can understand attack paths across identity, network, application, and cloud layers before an adversary moves laterally, according to Illumio's Black Hat 2025 conversation with CyberWire's Bennett Moe and Cloud Security Alliance CEO Jim Reavis. The strategic shift is clear: if your map is incomplete, AI makes the gap more dangerous, not less.
Editorial analysis by NHI Mgmt Group, based on content published by Illumio: “Mapping the Future: Why Cybersecurity Visibility is the Greatest Advantage”.
Key questions
Q: Why do compliance reviews fail to predict breach risk in cloud and identity environments?
A: Compliance reviews often prove that a control was documented at a point in time, not that it stayed effective.
A: Security teams should centralise telemetry from existing tools into one view and map relationships between assets, identities, and controls.
Q: What are the signs that cloud dependency tracking is failing?
A: Frequent 'what changed?' investigations, manual reconstruction during incidents, inconsistent postmortem findings, and uncertainty about route, access, or service dependencies all indicate that relationship history is missing or incomplete.
Practitioner guidance
- Integrate identity, network and application maps Correlate identity relationships with network and service dependency data so analysts can trace plausible attack paths across layers instead of reviewing each domain in isolation.
- Refresh cloud dependency inventories continuously Track provider regions, third-party APIs and fallback routes as living operational dependencies, not static architecture diagrams.
- Use AI to accelerate correlation, not assumptions Apply automation to surface relationship changes and prioritise alerts, but validate the underlying access and dependency data before making containment decisions.
Bottom line: Security visibility now functions as a resilience control because it shows how identity, network, application and cloud relationships can be chained by an attacker.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
12/07/2026 12:38 pm
Visibility mapping is now a governance control, not just an operations aid. The article shows that teams cannot govern access they cannot see in relation to other systems, which is especially true where identity, network and application layers are managed in separate tools. That makes relationship mapping a prerequisite for both IAM and cloud resilience. Practitioners should treat incomplete visibility as a control gap, not a reporting inconvenience.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
A: Whenever dependency chains can affect business continuity, security containment or recovery decisions. If a hidden route, provider dependency or identity relationship could let an attacker move laterally or disrupt a service, visibility has become part of resilience governance and should be managed that way.
👉 Read our full editorial: Visibility mapping is now the core advantage in cyber resilience