Notifications
Clear all
Topic starter
25/08/2026 6:10 pm
TL;DR: Identity security is shifting from authentication to authorization because attackers increasingly log in with valid credentials, not exploits, and insurers are asking for proof of privilege control, NHI accountability, and third-party access limits, according to Veza. The practical test is whether organisations can continuously show who can do what, across users, NHIs, API keys, AI agents, and vendors, before premiums and coverage decisions harden.
NHIMG editorial — based on content published by Veza: Identity security posture and cyber insurability
By the numbers:
- Ransomware accounted for 58% of large claims, showing how identity abuse now translates directly into insurance loss.
- 79% of attacks are now malware-free, as adversaries increasingly rely on valid credentials and access abuse instead of payloads.
Questions worth separating out
Q: What breaks when identity controls focus only on authentication?
A: Authentication-only programmes miss the point where most modern attacks succeed: after a valid login.
Q: Why do NHIs complicate cyber insurance and identity governance?
A: NHIs complicate governance because they are numerous, frequently over-permissioned, and often lack clear human ownership.
Q: What do security teams get wrong about least privilege in mixed identity estates?
A: They often treat least privilege as a provisioning-time policy instead of a continuously verified access state.
Practitioner guidance
- Inventory effective permissions across all identities Map who can take what action on what data across users, NHIs, API keys, AI agents, and third parties.
- Build NHI accountability into access governance Assign a human owner, review cadence, and revocation path to every service account, token, key, and agent credential.
- Measure insurability with access evidence Prepare evidence for least privilege, SoD checks, third-party access limits, and access review outcomes in a format that can be reused for underwriting, audit, and incident review.
What's in the full article
Veza's full analysis covers the operational detail this post intentionally leaves for the source:
- How the Access Graph correlates authorization metadata across 300+ enterprise systems for more granular access mapping.
- How Access Intelligence surfaces privileged users, dormant permissions, and policy violations through 2000+ pre-built queries.
- How Access Monitoring and risk scoring support access review workflows, least-privilege remediation, and insurance-ready reporting.
- How the identity risk posture data can be translated into underwriting evidence and lifecycle management outputs.
👉 Read Veza's analysis of authorization data for cyber insurance and identity risk →
Identity authorization and cyber insurance: what should teams prove now?
Explore further
25/08/2026 6:11 pm
Authorization is becoming the decisive identity control because attackers increasingly bypass exploits altogether. Once a valid credential exists, authentication stops being the meaningful control boundary and access scope becomes the real battleground. That shifts IAM and PAM from login assurance to permission containment, and organisations that cannot prove effective rights will struggle to defend both security posture and insurability.
A few things that frame the scale:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, which explains why machine access remains one of the least governable identity layers.
A question worth separating out:
Q: How should organisations prove identity governance is reducing risk, not just activity?
A: They should measure whether access decisions change exposure, not just whether workflows complete. That means tracking risky entitlement removal, orphaned account reduction, privileged access coverage, and the time it takes to revoke access after it is no longer justified. If the metrics only show volume and speed, the programme may be busy without being effective.
👉 Read our full editorial: Authorization-focused identity security is now an insurability issue
