Notifications
Clear all
Topic starter
24/06/2026 7:44 pm
TL;DR: Identity-based attacks now span compromised credentials, phishing, cloud misconfiguration, privilege escalation, persistence, and exfiltration, with CrowdStrike saying valid account abuse drove 35% of cloud-related incidents and Hydden arguing that blind spots make traditional IAM a paper shield. The core problem is that identity controls are often built around assumed states rather than continuous discovery and context.
NHIMG editorial — based on content published by Hydden: From Account Creation to Data Exfiltration
By the numbers:
- Valid account abuse was responsible for 35% of cloud-related incidents.
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
- Only 5.7% of organisations have full visibility into their service accounts.
Questions worth separating out
Q: How should security teams reduce identity-based initial access risk?
A: Security teams should focus on credential exposure, phishing resistance, and detection of abnormal authentication patterns.
Q: Why do service accounts and API keys increase lateral movement risk?
A: Service accounts and API keys increase lateral movement risk when they are over-permissioned, long-lived, or poorly tracked.
Q: What breaks when identity inventories are incomplete?
A: When identity inventories are incomplete, defenders cannot tell which accounts are legitimate, which are dormant, and which are attacker-created.
Practitioner guidance
- Build continuous identity discovery into the control stack Replace periodic audits with always-on discovery across cloud, SaaS, on-prem, and CI/CD so shadow identities and unmanaged credentials are visible before attackers find them.
- Tighten lifecycle controls for service accounts and API keys Track creation, rotation, ownership, and offboarding for every non-human identity, and treat orphaned credentials as active attack paths rather than housekeeping issues.
- Inspect privilege edges between IAM, PAM, and cloud roles Map where one compromised identity can reach another, especially across privileged groups, service principals, and PAM workflows that can widen blast radius.
What's in the full article
Hydden's full analysis covers the operational detail this post intentionally leaves for the source:
- Detailed identity attack lifecycle examples across cloud, SaaS, and hybrid environments
- Specific tactics for discovering shadow identities and tracking account creation anomalies
- Practical guidance for correlating identity telemetry with vulnerability findings
- Source commentary on IASM as a control layer for Zero Trust programmes
👉 Read Hydden's analysis of the identity attack lifecycle and IASM →
Identity attack lifecycle: what IAM teams need to fix now?
Explore further
25/06/2026 5:09 am
Identity attack surface management is now the missing control plane for modern IAM. Traditional IAM assumes it can govern what it can enumerate, but attackers exploit identities that are stale, shadowed, or too complex for periodic review. The operational failure is not policy design alone. It is the gap between declared access and the actual identity battlefield, which makes continuous discovery a prerequisite for meaningful governance.
A few things that frame the scale:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, which explains why identity-driven attacks keep finding unmonitored footholds.
A question worth separating out:
Q: Who is accountable when identity abuse leads to ransomware or exfiltration?
A: Accountability sits with the organisation’s identity governance, security operations, and control owners together. If identity telemetry, lifecycle processes, and privilege review failed to prevent abuse, the programme has to answer for that weakness. Frameworks such as NIST SP 800-207 Zero Trust Architecture help clarify shared responsibility across access verification and enforcement.
👉 Read our full editorial: Identity attack lifecycle is now the primary enterprise access path
