Topic starter
02/08/2026 11:54 am
TL;DR: 60% of successful breaches are expected to be identity-based in 2026, showing how much trusted sessions and SaaS workflows now matter, according to Exaforce's blog post. Runtime visibility and blast-radius containment become central because authentication alone no longer defines trust.
Editorial analysis by NHI Mgmt Group, based on content published by Exaforce: “7 predictions for the security landscape in 2026”.
By the numbers:
- Identity-based attacks will officially exceed 60% of all successful breaches by 2026, according to Exaforce.
Key questions
Q: Why do OAuth sessions create more risk than traditional login events?
A: OAuth sessions can carry trust forward after the initial authentication step, which means one successful approval can unlock access across multiple services.
Q: How should security teams detect abuse when attackers use legitimate identities?
A: Security teams should correlate successful authentication with downstream behaviour such as unusual file access, privilege escalation, bulk export, and lateral movement.
Q: What breaks when attackers can steal MFA session tokens?
A: MFA stops being the control point once the attacker has a valid token or cookie.
Practitioner guidance
- Instrument post-login behaviour Correlate successful authentication with activity patterns, data access, and privileged actions so that anomalous behaviour is visible after the login event.
- Revoke sessions globally on drift Create a runbook for terminating active sessions, OAuth grants, and tokens when an identity starts acting outside its expected behavioural baseline.
- Treat third-party identities as live access paths Monitor vendor integrations, API tokens, and connected SaaS accounts with the same scrutiny used for internal privileged accounts.
Bottom line: The article’s central warning is that identity compromise now happens through trusted sessions, not just broken logins or malicious binaries.
Glossary terms: Session abuse, Runtime Vendor Risk, Identity Blast Radius, Post-Authentication Monitoring
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 days ago by NHI Mgmt Group
02/08/2026 1:02 pm
Identity trust has moved from a login event to a runtime decision: The article is right that authentication alone no longer defines trust, because attackers increasingly operate through valid sessions, tokens, and SaaS permissions. That shifts the governance problem from identity proof to identity behaviour, which is a materially different control question. Programmes that stop at the gate are measuring entry, not risk.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What should organisations change when third-party risk depends on runtime behaviour?
A: They should move from document-based assurance to live monitoring of third-party identities, tokens, and integrations. The practical question is whether a vendor connection is behaving inside its expected scope today, not whether it passed a questionnaire months ago. Runtime evidence must drive containment and review.
👉 Read our full editorial: Identity attacks, session abuse, and vendor risk will dominate 2026