Topic starter
24/06/2026 7:44 pm
TL;DR: Identity attack surface management exposes blind spots traditional IAM, PAM and IGA miss, including shadow identities, overprivileged accounts and leaked secrets, according to Hydden, while IBM and Verizon figures cited in the article show how costly and slow identity-driven incidents can be. The measurable risk is not coverage but undiscovered exposure that turns compliance into a false signal.
Editorial analysis by NHI Mgmt Group, based on content published by Hydden: “Measuring the ROI of Proactive Identity Attack Surface Management (IASM)”.
By the numbers:
- Identity-based attacks make up 30% of total intrusions, according to IBM Threat Intelligence Index data cited by Hydden.
- The average cost of a data breach reached $4.88 million in 2024, according to IBM Threat Intelligence Index data cited by Hydden.
- Leaked credentials had a median remediation time of 94 days, according to Verizon DBIR data cited by Hydden.
Key questions
Q: What breaks when governance only covers one identity ecosystem?
A: Governance breaks when it cannot see access consistently across cloud, on-premise, and SaaS systems.
Q: Why do over-privileged identities increase breach impact?
A: Over-privileged identities expand the damage a stolen credential can do because the attacker inherits more pathways into sensitive systems.
Q: How can teams tell whether identity attack surface management is working?
A: It is working when the number of high-risk identities falls, exposed credentials are retired faster, and reachable privileged paths shrink over time.
Practitioner guidance
- Implement continuous identity discovery Inventory human, machine, cloud and legacy application identities on an always-on basis so unknown accounts and entitlements do not remain outside governance until an audit or incident exposes them.
- Correlate identities to reachable privilege Tie each identity to entitlements, authentication method, resource relationships and observed activity so the team can see which identities expand the blast radius if compromised.
- Prioritise remediation by exposure and privilege Rank leaked secrets, dormant accounts, overprivileged service identities and toxic entitlement combinations ahead of low-risk hygiene tasks, because those are the paths most likely to matter in a breach.
Bottom line: Traditional IAM, PAM and IGA can still leave shadow identities, misconfigured entitlements and leaked credentials outside effective governance.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 5:10 am
Identity attack surface management is a visibility discipline, not a reporting layer. Traditional IAM, PAM and IGA were designed to govern known identities, so they cannot reduce risk they never see. That makes continuous discovery the structural prerequisite for any credible identity security programme. Practitioners should treat attack surface reduction as the primary outcome, not compliance completion.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What is the difference between attack surface discovery and access certification?
A: Attack surface discovery finds what identities, secrets and entitlements actually exist, while access certification checks whether known access should remain approved. Discovery expands the inventory, certification reviews the inventory you already have. If discovery is incomplete, certification can only validate a partial picture and may miss the identities most likely to be abused.
👉 Read our full editorial: Identity attack surface management and the cost of invisible risk