Notifications
Clear all
Topic starter
22/06/2026 9:54 am
TL;DR: Account takeover response can move from hours to minutes when behavioural detection is paired with immediate data containment, reducing the window for exfiltration and limiting blast radius, according to Cyera and Abnormal. Detection alone no longer answers the governance question that matters most: how fast can an identity’s reach be constrained before data moves?
NHIMG editorial — based on content published by Cyera: Contain Account Takeovers in Minutes with Abnormal AI and Cyera
By the numbers:
- Breached credential incidents take an average of 246 days to identify and contain, with containment alone averaging 60 days.
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases.
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys.
Questions worth separating out
Q: How should security teams contain account takeover before data moves?
A: Security teams should connect identity-risk detection to automatic enforcement that reduces access the moment compromise is suspected.
Q: Why do account takeovers create a data-governance problem as well as an identity problem?
A: Because the attacker inherits the user’s existing permissions, so the true risk is not only who signed in, but what that identity can reach.
Q: What breaks when teams rely on investigation before containment in ATO cases?
A: The main failure is that the attacker keeps full access during the most dangerous period.
Practitioner guidance
- Bind ATO detection to immediate containment policy Define response rules so a high-risk identity signal automatically tightens data access, blocks sensitive sharing, and removes dangerous exceptions before analyst review completes.
- Map the compromised-user blast radius in advance Use DSPM to identify which repositories, SaaS apps, and data stores a typical employee can reach so containment targets the highest-value exposures first.
- Rework incident playbooks around bounded access windows Replace sequential detect-investigate-remediate steps with pre-approved containment actions that can execute while the SOC is still validating compromise.
What's in the full article
Cyera's full research covers the operational detail this post intentionally leaves for the source:
- Step-by-step detection-to-containment workflow details for Abnormal and Cyera in the Public Preview integration
- Specific DLP enforcement actions pushed into Microsoft Purview for compromised identities
- Analyst workflow examples showing how DSPM narrows blast radius during active takeover response
- The article's full FAQ on account takeover containment, detection latency, and policy enforcement
👉 Read Cyera's analysis of account takeover containment with Abnormal AI →
Account takeover containment in minutes: are your controls keeping up?
Explore further
22/06/2026 10:33 am
Containment latency is the real account-takeover risk: ATO is not just a detection problem, it is a race between identity compromise and access restriction. When teams can identify compromise but cannot immediately narrow data reach, the attacker operates inside a live access window. That is why identity governance and data control have to be treated as one response plane. Practitioners should measure how long an identity can still move after compromise is detected.
A few things that frame the scale:
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to the Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Who is accountable when account takeover exposes sensitive data?
A: Accountability sits across identity, security operations, and data governance because the incident spans authentication, access enforcement, and data protection. Frameworks such as OWASP NHI and NIST CSF both support the view that compromise response must include fast privilege restriction, not just detection and ticketing.
👉 Read our full editorial: Account takeover containment now depends on data control, not just detection
