Topic starter
11/11/2026 6:01 pm
TL;DR: Every incident in its 2025 dataset touched at least one unprotected or rogue endpoint, and 96% of lateral-movement cases ended with ransomware, according to Barracuda. Endpoint and third-party exposure now shorten the path from first foothold to business disruption.
Editorial analysis by NHI Mgmt Group, based on content published by Barracuda: “The Managed XDR Global Threat Report”.
By the numbers:
- 100% of security incidents involved at least one unprotected or rogue endpoint.
- 66% of incidents involved the supply chain or a third party.
- 96% of incidents involving lateral movement ended with the release of ransomware.
Key questions
Q: Why do unprotected endpoints increase identity risk?
A: Unprotected endpoints increase identity risk because they are easier to compromise, letting attackers steal tokens, browser sessions, certificates, or cached credentials from a laptop or server before controls like MFA or conditional access can help.
A: The break point is the assumption that access remains stable long enough for human review or remediation.
Q: How do attackers turn a user login into ransomware?
A: Attackers usually turn a user login into ransomware by stealing credentials, hijacking a session, or abusing a valid account to gain initial access, then escalating privileges and disabling defences before deploying malicious encryption tools.
Practitioner guidance
- Restrict trust in unmanaged endpoints Block high-risk access from devices that are not enrolled, posture-checked or continuously monitored, especially for remote logins and privileged sessions.
- Contain privilege escalation paths Reduce the blast radius of any initial access by limiting standing privilege, separating admin functions and alerting on rapid permission changes.
- Reassess third-party identity paths Apply stronger approval, scoping and monitoring to supplier accounts, integrations and remote support paths that can reach production systems.
Bottom line: The report ties ransomware outcomes to a chain that starts with identity compromise, moves through privilege escalation and ends in rapid encryption.
Glossary terms: Ransomware, Rogue Endpoint, Unprotected Endpoint, Privilege Escalation
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/11/2026 6:06 pm
Identity compromise is now an endpoint problem as much as an access problem. Barracuda's findings show that the first durable weakness is often the device, not the account itself. Once an attacker lands on an unprotected or rogue endpoint, identity controls lose context and privilege abuse becomes far easier. Practitioners should stop treating endpoint hygiene and identity governance as separate workstreams.
A few things that frame the scale:
- 74% of organizations report identity-related breaches, and privileged access is a leading cause of lateral movement.
A question worth separating out:
Q: How should teams detect risky third-party access before it is abused?
A: Look for external identities with broad scopes, long-lived secrets, and permissions that no longer match current contracts or operational need. Those are the strongest indicators that trust has outgrown governance. Monitoring should focus on issued credentials, last-used dates, and whether the integration still has a valid business owner.
👉 Read our full editorial: Identity attacks, rogue endpoints and vendors speed ransomware attacks