Notifications
Clear all
Topic starter
02/08/2026 11:53 am
TL;DR: Iranian threat activity is increasingly decentralized and opportunistic, with recent campaigns targeting internet-facing infrastructure, identity systems, and operational technology to create disruption across Western commercial environments, according to Horizon3.ai. The security problem is no longer isolated intrusion but repeated exposure across edge, identity, and recovery controls that attackers can exploit faster than defenders respond.
NHIMG editorial — based on content published by Horizons.ai: When Conflict Extends Into Cyberspace: What Security Leaders Should Expect
By the numbers:
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases.
- Lack of credential rotation is cited as the top cause of NHI-related attacks by 45% of organisations, followed by inadequate monitoring and logging and over-privileged accounts at 37% each.
Questions worth separating out
Q: How should security teams reduce the blast radius of edge compromise?
A: Treat internet-facing gateways as entry points into identity risk, not isolated infrastructure assets.
Q: Why do service accounts and cloud identities complicate PAM governance?
A: They often gain rights incrementally through automation, project changes, or platform expansion, so their effective access can outgrow the original classification.
Q: What breaks when organisations do not validate identity pivot paths?
A: Teams lose sight of how attackers can move from a single exposed device into authentication systems, admin consoles, and downstream services.
Practitioner guidance
- Reassess internet-facing exposure weekly Track all VPNs, firewalls, remote access systems, and management interfaces that are reachable from the internet.
- Map and constrain identity pivot paths Review Active Directory, cloud directories, service accounts, and privileged tokens for reuse potential.
- Harden remote administration and OT trust chains Segment operational technology and remote administration pathways so support access cannot be reused broadly.
What's in the full article
Horizons.ai's full blog covers the operational detail this post intentionally leaves for the source:
- Specific Iranian threat-actor references and the associated campaign patterns that informed the analysis.
- Companion research on Iranian APT activity, including the technical observations behind the edge and identity focus.
- Examples of attack path validation using an autonomous security platform to test real exploitability.
- Recommended executive messaging for maintaining calm, fact-based communication during heightened geopolitical risk.
👉 Read Horizons.ai's analysis of Iranian cyber campaign patterns and identity risk →
Iranian cyber campaigns and the identity controls attackers keep targeting?
Explore further
02/08/2026 1:02 pm
Decentralized disruption is now a governance model, not just a threat pattern. The article shows that Iranian activity is moving away from a single campaign structure and toward distributed opportunistic attacks. That matters because defenders cannot rely on one narrow detection hypothesis. Security leaders need exposure management, identity control, and recovery planning to work as a system, not as separate workstreams.
A question worth separating out:
Q: Who should be accountable when third-party access is abused?
A: Accountability should sit with the teams that own the access path, the detection logic, and the response workflow. Third-party access is not a special exception to identity governance; it is a high-risk access category that needs explicit ownership, monitoring, and containment rules. Without that clarity, the organisation can see the event but fail to respond decisively.
👉 Read our full editorial: Iranian cyber campaigns are shifting toward decentralized disruption
