Topic starter
11/11/2026 6:04 pm
TL;DR: 5.7% of organisations have full visibility into service accounts, according to Crytica Security's survey-linked evidence, which shows how hard it is to govern identities that sit inside operational systems. Security teams need device-level and identity-level signals together, or unauthorized changes stay hidden long enough to matter.
Editorial analysis by NHI Mgmt Group, based on content published by Crytica Security: “Government Cybersecurity Is Shifting from Visibility to Action — Why Rapid Detection Matters More Than Ever”.
Key questions
Q: Why does delayed detection make critical infrastructure harder to defend?
A: Delayed detection gives attackers or faults more time to move from a local issue to a control-system or safety impact, especially where monitoring is sparse and response windows are short.
Q: How does device-level monitoring differ from network visibility?
A: Device-level monitoring collects evidence from the endpoint itself, such as process creation, registry changes, file writes, user logons and security telemetry.
Q: How should teams detect compromise in constrained OT devices?
A: Use device-level integrity checks, because constrained OT devices often lack rich endpoint telemetry.
Practitioner guidance
- Instrument the device, not only the perimeter Add controls that can confirm internal state change on constrained OT and IoT assets, especially where endpoint agents cannot run reliably.
- Measure dwell time by asset class Separate OT, IoT, and traditional IT response metrics so leadership can see where unauthorized change remains hidden longest and why.
- Map high-value systems to faster triage paths Predefine which government, utility, or mission-critical assets trigger immediate validation and escalation when an unauthorised change is detected.
Bottom line: Government cybersecurity programmes fail when they can observe traffic but cannot confirm internal device change fast enough to act.
Glossary terms: Dwell Time, Operational Technology, Device Integrity, Non-Human Identity (NHI)
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/11/2026 6:06 pm
Visibility is not the control, rapid confirmation of state change is. Security programmes often treat visibility as the objective, but in constrained OT and IoT environments the real governance question is whether a device has changed without authorisation. When the most important change happens inside the endpoint, external monitoring is necessary but insufficient. The practitioner conclusion is simple: if the device state is not verifiable quickly, the programme is still relying on inference.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What happens when unauthorized change goes undetected for weeks?
A: An undetected unauthorised change can persist into production, alter safety or control logic, and hide the real source of faults for weeks. Recovery then depends on reconstructing when the change occurred, what was altered, and whether related credentials, maintenance access, or remote management paths were also abused.
👉 Read our full editorial: Government cybersecurity needs faster detection beyond visibility