Topic starter
24/06/2026 7:44 pm
TL;DR: Identity-based attacks now span compromised credentials, phishing, cloud misconfiguration, privilege escalation, persistence, and exfiltration, with CrowdStrike saying valid account abuse drove 35% of cloud-related incidents and Hydden arguing that blind spots make traditional IAM a paper shield. The core problem is that identity controls are often built around assumed states rather than continuous discovery and context.
Editorial analysis by NHI Mgmt Group, based on content published by Hydden: “The Lifecycle of an Identity Attack”.
Key questions
Q: What breaks when identity governance focuses only on account counts?
A: When governance focuses only on account counts, teams miss the identities that can actually reach sensitive data or production systems.
Q: Why do compromised credentials and phishing drive such high breach costs in modern environments?
A: Compromised credentials and phishing are costly because they often give attackers trusted access that is hard to distinguish from legitimate activity.
Q: How can teams tell whether identity attack surface management is working?
A: It is working when the number of high-risk identities falls, exposed credentials are retired faster, and reachable privileged paths shrink over time.
Practitioner guidance
- Mandate continuous identity discovery Inventory human, machine and application identities across on-prem, cloud and SaaS so attack paths are visible before they are exploited.
- Correlate identity events with vulnerability exposure Join account creation, privilege change and authentication telemetry with vulnerability and cloud configuration data to expose full attack paths.
- Prioritise NHI governance for tokens and service accounts Apply least privilege, credential rotation, vaulting and JIT access to service accounts, API keys and cloud roles that can be reused for lateral movement.
Bottom line: Identity-based attacks succeed because they exploit the gap between what IAM believes exists and what attackers can actually use.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 5:09 am
Identity attack surface is the real enterprise control plane: The article is right to frame identity as the primary access path because attackers no longer need to break in around identity when they can break in through it. IAM that only manages approved accounts but does not continuously discover shadow accounts, cloud roles and machine identities is governing a partial reality. The practitioner implication is that identity visibility now defines security coverage.
A question worth separating out:
Q: How should organizations respond to OAuth token abuse incidents?
A: Organizations should promptly revoke compromised OAuth tokens, audit access logs, and implement regular credential rotation policies. This helps to mitigate the risk of further unauthorized access and aligns with proactive NHI management.
👉 Read our full editorial: Identity attack lifecycle is now the primary enterprise access path