Topic starter
25/06/2026 12:20 am
TL;DR: 69% of organisations experienced an identity-related breach in the last three years, 24% saw breach costs above $10M, and 90% still face passwordless adoption challenges as help desk hijacks intensify, according to RSA Security’s 2026 ID IQ Report. Identity governance now fails at the recovery and support layers, not just at login.
Editorial analysis by NHI Mgmt Group, based on content published by RSA Security: “Identity Security Failed 75% of German Organizations: RSA ID IQ Report Unveils Top Identity Threats”.
By the numbers:
- 69% of organisations experienced an identity-related breach in the last three years.
- 24% of organisations said identity-related breach costs exceeded $10M.
Key questions
Q: What breaks when the help desk becomes an authentication back door?
A: The main failure is that identity proofing becomes weaker at the exact point where attackers can influence a human operator.
Q: Why do passwordless programmes still get compromised through recovery paths?
A: Because passwordless improves the login step, not every way identity is re-established.
Q: How can security teams tell whether identity breach risk is improving?
A: Look beyond enrollment numbers and check whether support-mediated actions are shrinking, harder to complete, and more heavily logged.
Practitioner guidance
- Harden help desk verification Require stronger identity proofing for password resets, MFA resets, and device replacement requests than for ordinary sign-in flows.
- Map recovery paths as privileged flows Document every account recovery route, escalation path, and manual override that can restore access.
- Test service desk resistance to social engineering Run controlled exercises against reset, unlock, and callback procedures to see whether staff can distinguish genuine users from persuasive attackers.
Bottom line: Identity-related breaches are rising because attackers increasingly exploit support and recovery workflows, not only primary login controls.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 9:14 am
Help desk governance has become part of the identity perimeter: The report confirms that the most consequential identity failures increasingly happen in support workflows, not only in primary authentication. That changes the programme boundary for IAM, PAM, and IGA teams, because recovery and reset processes can now determine breach likelihood as much as credential policy. Organisations that still treat the service desk as a back-office function are leaving a control gap in the middle of the identity stack.
A few things that frame the scale:
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Who should own account recovery risk in an identity programme?
A: Recovery risk should be owned jointly by IAM, service desk leadership, and security governance. Authentication is not complete until recovery is controlled, so the accountable team must cover the full identity journey, including fallback access, verification rules, and support approvals.
👉 Read our full editorial: Identity breaches keep rising as help desk hijacks intensify