Topic starter
24/06/2026 7:34 pm
TL;DR: Opal Security's analysis of ten recent breaches finds repeated identity governance failures, including stale credentials, missing MFA, over-privileged accounts, and weak third-party access, across incidents affecting more than 700 million people. That scale suggests governance has to be continuous, or the same control gaps will keep creating major compromise paths.
Editorial analysis by NHI Mgmt Group, based on content published by Opal Security: “10 Recent Breaches that Could Have been Prevented with Modern IGA”.
Key questions
Q: Why do overprivileged accounts make breaches harder to contain?
A: Because the compromise of one account becomes the compromise of whatever that account can already reach.
Q: How do you know if an access review programme is actually working?
A: Look beyond completion rate.
Q: What breaks when stale credentials and missing MFA are still allowed in production?
A: They create durable entry points that attackers can reuse long after the original leak or theft.
Practitioner guidance
- Audit credential age and MFA coverage Identify service accounts, SaaS logins, and legacy portals where credentials are old, unrotated, or not covered by MFA.
- Reduce standing privilege on non-human identities Review service accounts, OAuth apps, and support tooling for permissions that exceed the minimum required for the current task or integration.
- Re-baseline third-party access after every relationship change Reconfirm vendor and contractor access whenever work changes, an engagement ends, or systems are acquired.
Bottom line: These breaches were not driven by a single new exploit pattern, but by repeated failures in identity governance and access control.
Glossary terms: Identity Governance and Administration (IGA), Standing Privilege, Access Review, Third-Party Access Governance
What's in the full article
Opal Security's full article covers the incident-by-incident access failures this analysis intentionally leaves at a higher level:
- Detailed breakdown of each of the ten breaches, including the specific identity control that failed in each case
- Per-incident impact figures, from customer counts to ransom payments and outage duration
- The vendor's mapped prevention logic for just-in-time access, access reviews, and third-party governance
- Examples of how legacy systems, service accounts, and outsourced support created recurring governance gaps
👉 Read Opal Security's analysis of the recent breaches modern IGA could have reduced →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
25/06/2026 4:56 am
Modern IGA is now a breach containment control, not just an admin function. The incidents in this review show that access governance failures are doing the work of exploitation for attackers. When credentials are stale, MFA is missing, or accounts are never re-reviewed, adversaries do not need a novel exploit to reach sensitive systems. The practitioner conclusion is that IGA has become part of the breach prevention stack, not a back-office entitlement process.
A few things that frame the scale:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
A question worth separating out:
Q: What should organisations do when third-party access outlives the business need?
A: Treat the access as a lifecycle problem, not a one-time approval. Revalidate vendor and contractor access whenever scope, ownership, or service relationships change, and remove support paths that no longer match the current engagement. That is how organisations prevent outsourced access from becoming a standing breach pathway.
👉 Read our full editorial: Modern IGA would have reduced the damage in recent breaches