Topic starter
25/06/2026 2:45 pm
TL;DR: 69% of organisations experienced an identity-related breach in the last three years, a 27-point year-over-year increase, while 45% said breach costs exceeded IBM's benchmark and 24% said losses passed $10M, according to RSA Security's 2026 ID IQ Report. Identity failure is now a governance and cost problem, not just an authentication problem.
Editorial analysis by NHI Mgmt Group, based on content published by RSA Security: “Soaring Identity Costs and Stalling Passwordless Progress in Japan: RSA ID IQ Report Unveils Top Identity Threats”.
By the numbers:
- 69% of global organizations experienced an identity-related breach in the last three years, a 27-percentage-point increase year-over-year.
- 45% of organizations said that the cost of an identity-related breach exceeded the typical cost of a breach as defined by IBM.
- 24% of organizations said identity-related breach costs exceeded $10M.
Key questions
Q: What breaks when passwordless still depends on password recovery?
A: The assurance model breaks because the passwordless front end is undercut by a password-based back door.
Q: Why do help desk hijacks create such high breach costs?
A: Because the attack does not stop at access.
Q: How can IAM teams tell whether passwordless is actually reducing risk?
A: Look for fewer password-related support events, lower exposure to reused secrets, and a narrower attack path for phishing and replay attacks.
Practitioner guidance
- Audit recovery-path trust boundaries Map every account recovery, reset, and MFA rebind workflow to identify where support staff can override authentication without equivalent proofing.
- Reclassify help desk overrides as privileged actions Require step-up verification, approval logging, and limited delegation for any support action that can restore or alter identity credentials.
- Measure passwordless alongside fallback use Track how often users are forced back to passwords, resets, or support-mediated recovery, then treat those paths as risk indicators rather than exceptions.
Bottom line: Identity breaches are rising because attackers are increasingly targeting the recovery path, not just the password prompt.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 20 hours ago by NHI Mgmt Group
25/06/2026 3:52 pm
Help desk recovery is now part of the identity perimeter: RSA Security's findings show that modern identity attacks increasingly target the support path rather than the login box. That matters because passwordless only reduces risk when recovery, re-verification, and override workflows are governed as privileged access. The practitioner conclusion is simple: the control boundary has moved.
A few things that frame the scale:
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Who should own account recovery risk in an identity programme?
A: Recovery risk should be owned jointly by IAM, service desk leadership, and security governance. Authentication is not complete until recovery is controlled, so the accountable team must cover the full identity journey, including fallback access, verification rules, and support approvals.
👉 Read our full editorial: Identity breaches surge as passwordless progress stalls in Japan
This post was modified 20 hours ago by NHI Mgmt Group