Notifications
Clear all
Topic starter
20/08/2026 5:32 pm
TL;DR: China-linked attacks against small utilities show that stolen login credentials and identity access paths, not perimeter firewalls, are the operational weak point, according to Ory. For IAM and NHI teams, the lesson is that zero-trust design only holds when identity, session, and privilege controls are treated as the real perimeter.
NHIMG editorial — based on content published by Ory: The China Hack and the New Front Line: Why Identity is the Only Perimeter Left
Questions worth separating out
Q: How should security teams respond when credentials are exposed at massive scale?
A: Start with session invalidation, then rotate or revoke the affected secrets, tokens, and passwords.
Q: Why do stolen credentials defeat traditional perimeter controls so effectively?
A: Perimeter controls are designed to stop unauthorised traffic, not authenticated traffic from a valid identity.
Q: What breaks when third-party access is not included in identity governance?
A: Auditability breaks first, followed by containment.
Practitioner guidance
- Re-centre the perimeter on identity assurance Map the controls that determine whether a session is trustworthy after authentication.
- Audit durable access paths for operational systems Identify persistent admin accounts, shared credentials, remote access accounts, and service identities that can reach critical utility workflows.
- Shorten the window between compromise and containment Test how quickly the organisation can disable access, invalidate sessions, and confirm propagation across connected systems.
What's in the full article
Ory's full blog post covers the security and identity context this post intentionally leaves at the strategic level:
- The article’s specific China-linked utility attack context and why it matters for defenders.
- Ory's framing of identity as the operational perimeter and how that changes control priorities.
- The broader security argument behind zero-trust identity design in utility environments.
👉 Read Ory's analysis of why identity is the only perimeter left in utility attacks →
China-linked utility attacks: what identity teams need to rethink?
Explore further
20/08/2026 6:19 pm
Identity is now the perimeter because valid access has become the easiest route around traditional defences. Once attackers hold credentials, network controls lose much of their value because the traffic looks authorised. That shifts the centre of gravity from edge security to identity assurance, session governance, and privilege containment.
A few things that frame the scale:
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
- Organisations maintain an average of 6 distinct secrets manager instances, creating fragmentation that undermines centralised control, according to The State of Secrets in AppSec.
A question worth separating out:
Q: How can organisations tell whether identity has really become the perimeter?
A: Look at where the decisive trust decision happens. If authentication, session policy, and authorisation context are all enforced before a user or workload can reach critical systems, identity is the perimeter. If network location still carries most of the trust, it is not.
👉 Read our full editorial: Identity is the new perimeter in China-linked utility attacks
