Topic starter
10/07/2026 9:08 pm
TL;DR: Identity security weaknesses play a material role in nearly 90% of cyber incidents, and 89% of cases in Unit 42’s 2026 incident response report involve identity as the attack path, while 99% of cloud users, roles, and services hold excessive permissions, according to Zero Networks. Perimeter controls cannot contain valid-credential abuse when identity itself has become the boundary.
Editorial analysis by NHI Mgmt Group, based on content published by Zero Networks: “Perimeter-Based to Identity-Centric: Enforcing Least-Privilege Access Everywhere”.
By the numbers:
- Identity security weaknesses play a material role in nearly 90% of cyber incidents today, according to Zero Networks.
- Machine identities like service accounts make up more than 70% of networked identities, according to Zero Networks.
Key questions
Q: What breaks when perimeter security is treated as the main trust control?
A: Access governance becomes location-dependent instead of identity-dependent.
Q: Why do over-privileged identities make lateral movement easier?
A: Over-privileged identities make lateral movement easier because they already hold the permissions needed to talk to many systems, not just the one the task requires.
Q: What are the signs that identity-centric least privilege is not working?
A: Common signs include service accounts that can reach more systems than their application needs, dormant accounts that still retain broad access, and hybrid environments where access rules differ by platform rather than by identity intent.
Practitioner guidance
- Map identity blast radius by role Inventory which users, service accounts, and workloads can reach high-value systems and identify where the reachable set is wider than the business need.
- Segment machine identities separately Treat service accounts and application identities as first-class policy subjects, not as extensions of human access.
- Replace static trust with context-aware enforcement Use observed dependencies and approved operational need to generate access rules that change as systems move across cloud, SaaS, and on-premises boundaries.
Bottom line: Identity-centric least privilege replaces broad perimeter trust with access limits tied to the specific identity making the request.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 9:31 pm
Identity has become the control boundary, not the network edge: The article shows that perimeter trust models fail when valid credentials are the preferred entry point and identity is the mechanism for movement. That is a governance change as much as a tooling change, because access decisions now have to follow the identity across login, workload, and lateral reach. The practitioner conclusion is that segmentation policy must be built around identity scope, not just network placement.
A few things that frame the scale:
- 83% of privilege escalation incidents involved no CVE exploitation, according to Verizon's 2026 Data Breach Investigations Report.
A question worth separating out:
Q: Should security teams prioritise identity segmentation over perimeter hardening?
A: Security teams should prioritise identity segmentation when attackers already use valid credentials, cloud workloads, and service accounts to move inside the environment. Perimeter hardening still matters, but it cannot contain internal abuse by itself. The priority is to shrink what any one identity can do after authentication.
👉 Read our full editorial: Identity-centric least privilege is replacing perimeter trust models