Topic starter
11/07/2026 8:41 pm
TL;DR: September 2025 incidents across npm, healthcare, banking, and third-party support environments showed how secrets leakage, stale access, and supply chain compromise multiply blast radius once attackers move laterally, according to ColorTokens Threat Advisory. The pattern reinforces that containment and identity lifecycle controls matter as much as perimeter defence.
Editorial analysis by NHI Mgmt Group, based on content published by ColorTokens: “What a Rogue Package, a Ransomware Hit, and One Mistake Say About Cyber Risk Right Now”.
Key questions
Q: What breaks when offboarding is not tightly linked to access control?
A: Access can outlive the employment or role change that justified it, which creates privilege creep and audit gaps.
Q: Why do exposed secrets create such high operational and supply chain risk?
A: Exposed secrets can unlock production data, production workflows, and third party systems downstream in the software supply chain.
Q: How do security teams know whether containment is actually working?
A: They should test whether the identity can still execute privileged actions after revocation, not just whether the API call succeeded.
Practitioner guidance
- Tighten CI/CD and package-publishing secrets Move build and publish credentials out of long-lived environment variables, restrict their scope to the smallest usable action and rotate them after any build-system compromise.
- Automate offboarding across every access path Trigger deprovisioning from the authoritative HR event and verify revocation across VPN, email, cloud consoles, SaaS apps and privileged access tools.
- Reassess third-party token exposure Catalogue support tokens, vendor integrations and delegated access paths, then define revocation criteria for each one.
Bottom line: The incidents in this article show that lateral risk grows when secrets, tokens and stale identities remain usable after the original trust boundary has changed.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 9:07 pm
Blast-radius control is now a core identity problem, not only a network problem: the incidents described here all become worse after the first foothold because access is still usable across systems, workflows or third parties. That shifts the centre of gravity from simple prevention to containment by design. Practitioners should treat segmentation, token scope and lifecycle enforcement as a single governance plane.
A few things that frame the scale:
- 59% of compromised machines in a major 2025 supply chain attack were CI/CD runners rather than personal workstations, according to the State of Secrets Sprawl 2026.
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What is the difference between secret leakage and offboarding failure in lateral risk?
A: Secret leakage is the exposure of credentials or tokens that can be reused immediately, while offboarding failure is the persistence of valid access after a person should no longer have it. Both create lateral risk, but they fail in different places. Leakage is about credentials escaping control, while offboarding failure is about identity lifecycle controls not ending reach.
👉 Read our full editorial: Shai-Hulud, ransomware and offboarding failures expose lateral risk