Topic starter
24/06/2026 7:44 pm
TL;DR: Identity compromise now drives more than 80% of breaches, and attackers are increasingly exploiting dormant accounts, machine identities, MFA abuse, and hidden privilege paths to stay below the radar, according to Hydden. The governing assumption that periodic reviews can keep pace with continuously changing identity behavior is no longer reliable.
Editorial analysis by NHI Mgmt Group, based on content published by Hydden: “Are You Under Attack?”.
By the numbers:
- More than 80% of breaches now involve some form of identity compromise.
Key questions
Q: What breaks when dormant accounts are still treated as low-risk access?
A: Dormant accounts become a breach path when they are assumed to be safe simply because they are inactive.
Q: Why do machine identities create more risk than human identities in some environments?
A: Machine identities are often numerous, long-lived, and embedded in code or infrastructure.
Q: How can security teams tell whether MFA events indicate compromise?
A: Repeated prompts, factor downgrades, unexpected device enrolment, and fallback method abuse are all signs that authentication is under attack.
Practitioner guidance
- Implement continuous identity discovery Move beyond quarterly scans and reconcile human, machine, cloud admin, API token, and local accounts against active use signals.
- Correlate identity and vulnerability signals Link exploited system data with identity telemetry so a CVE on a host can trigger review of account creation, impersonation, or token abuse.
- Baseline identity behaviour Track login time, frequency, resource access, MFA changes, and device enrolment so drift is visible before privilege is abused.
Bottom line: Identity compromise is now the earliest useful indicator that a breach is underway, because attackers often hide inside trusted account behaviour.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 5:08 am
Identity compromise has become the operational signal that separates ordinary authentication noise from breach activity. The old assumption was that logins, role assignments, and MFA events were routine governance artefacts. That assumption fails when attackers use legitimate identity states as the intrusion path, because the control plane and the attack plane become indistinguishable. For practitioners, identity telemetry now has to be read as security evidence, not just admin activity.
A question worth separating out:
Q: How should IAM teams handle privileged access in shadow environments?
A: They should treat any privileged path in an unmanaged system as a governance exception until it is inventoried, owned, and reviewable. PAM controls lose effectiveness when local admins, ad hoc roles, or unmanaged SaaS privileges sit outside the review loop. The practical question is whether you can name the owner and revoke the access cleanly.
👉 Read our full editorial: Identity compromise is the new breach signal for NHI governance