Notifications
Clear all
Topic starter
11/07/2026 8:32 pm
TL;DR: Malware-free attacks accounted for 79% of detected threats in 2024, up from 40% in 2019, according to CrowdStrike, while Verizon says social engineering drives nearly a quarter of external breaches and valid credentials remain the most common initial access vector. Detection-first defence is not enough when attackers are using legitimate tools, identities, and network paths.
NHIMG editorial — based on content published by Zero Networks: How to Prevent Malware-Free Attacks: Living-off-the-Land Protection Strategies
By the numbers:
- Malware-free attacks accounted for 79% of detected threats in 2024, up from 40% in 2019.
- Social engineering attacks account for nearly a quarter of external security breaches, and phishing remains the most common form of social engineering at 57% of incidents.
- Only 2.6% of workload identity permissions are actually used, and 51% of workload identities are completely inactive.
Questions worth separating out
Q: How should security teams stop living-off-the-land attacks after a valid login?
A: They should assume the attacker already has a legitimate session and then constrain what that session can reach.
Q: Why do service accounts increase the damage from malware-free attacks?
A: Service accounts often have standing privilege, broad reach, and weak human oversight, which makes them ideal for silent abuse.
Q: What do security teams get wrong about fileless endpoint attacks?
A: Teams often assume fileless attacks are hard to see because they do not rely on traditional malware files.
Practitioner guidance
- Harden identity-aware microsegmentation Map every human and machine identity to the specific assets, ports, and protocols it legitimately needs, then deny everything else by default.
- Restrict native tool reach Limit where PowerShell, WMI, remote shell, and scheduled task execution are allowed, and tie those allowances to approved admin roles and change windows.
- Reassess service account privilege Review service accounts, API keys, and workload identities for unused permissions, inactive accounts, and cross-system access that is broader than their task scope.
What's in the full article
Zero Networks' full article covers the operational detail this post intentionally leaves for the source:
- Step-by-step guidance on blocking living-off-the-land tactics with automated microsegmentation and network-layer MFA.
- Practical examples of how to constrain privileged protocols such as RDP and RPC without relying on detection alone.
- Implementation detail on identity-aware policy creation across cloud, hybrid, and on-premises environments.
- The vendor's discussion of how its controls are positioned against malware-free attack paths in real deployments.
👉 Read Zero Networks' analysis of malware-free attack prevention strategies →
Living-off-the-land attacks: are your identity controls keeping up?
Explore further
11/07/2026 8:59 pm
Identity trust assumptions collapse when the attacker can operate as a legitimate user. Malware-free attacks work because many security programmes still assume that a successful login is evidence of legitimate intent. That assumption fails when the attacker arrives through stolen credentials, social engineering, or abused service accounts and then uses the same operating system tools as administrators. The implication is that identity trust can no longer be treated as a binary gate; it has to be continuously constrained by scope, context, and reachable assets.
A few things that frame the scale:
- 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to The State of Non-Human Identity Security.
- Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, according to The State of Non-Human Identity Security.
A question worth separating out:
Q: What should organisations prioritise before asking for more EDR coverage?
A: They should prioritise reducing identity blast radius. If overprivileged users and machine identities can reach too many assets, EDR will still see the activity after the fact. Segment the environment, remove excess permissions, and make privileged access conditional so the attacker cannot turn one login into full movement.
👉 Read our full editorial: Malware-free attacks expose the limits of detection-first defense
