Topic starter
25/08/2026 6:10 pm
TL;DR: Identity security is shifting from authentication to authorization because attackers increasingly log in with valid credentials, not exploits, and insurers are asking for proof of privilege control, NHI accountability, and third-party access limits, according to Veza. The practical test is whether organisations can continuously show who can do what, across users, NHIs, API keys, AI agents, and vendors, before premiums and coverage decisions harden.
Editorial analysis by NHI Mgmt Group, based on content published by Veza: “They’re Not Hacking In, They’re Logging In: Ensure Your Insurability in the New Threat Landscape”.
By the numbers:
- Ransomware accounted for 58% of large claims, according to Veza.
- 79% of attacks are now malware-free, according to Veza.
Key questions
Q: How should security teams prove authorization control to cyber insurers?
A: They should show current entitlement inventories, ownership for each identity, evidence of least privilege, and a repeatable review trail that demonstrates access is measured and reduced over time.
Q: Why do valid credentials still create risk after exploitation?
A: Valid credentials become dangerous when they are harvested through compromise and then reused in channels that look normal to monitoring tools.
Q: What do teams get wrong about non-human identity governance?
A: They often manage service accounts, tokens, and API keys with the same lifecycle assumptions used for human users.
Practitioner guidance
- Inventory all effective entitlements Build a complete map of who can access what across employees, service accounts, API keys, AI agents, and vendors, then reconcile it against current business need.
- Prove NHI ownership and accountability Assign a human owner to every non-human identity and document revocation paths, approved use, and lifecycle status for each one.
- Reduce dormant and over-permissioned access Identify unused privileges, stale accounts, and toxic combinations, then right-size roles to the minimum access needed for current operations.
Bottom line: The article reframes cyber insurability as an authorization problem because attackers are increasingly using valid access rather than exploits.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 3 hours ago by NHI Mgmt Group
25/08/2026 6:11 pm
Authorization has become the underwriting control plane: The article is right to move the discussion from authentication to authorization, because insurers are no longer satisfied with proof that a user logged in securely. What matters is whether the organisation can prove the scope, ownership, and revocation status of the access that follows login. For identity programmes, that turns entitlement governance into an insurability requirement, not a back-office reporting exercise.
A few things that frame the scale:
- 73% of vaults are misconfigured, leading to unauthorised access and exposure of sensitive data, according to the Ultimate Guide to NHIs.
- Stolen credentials were involved in 22% of breaches overall and in 88% of basic web application attacks, according to Verizon's 2025 Data Breach Investigations Report.
A question worth separating out:
Q: Should organisations treat third-party access as a privileged identity risk?
A: Yes, because third-party access often bypasses the same scrutiny applied to internal users while still reaching sensitive systems. Organisations should classify external accounts by privilege, require attestation, and remove access when the business need ends. If a supplier or integrator can alter records or administer systems, that access belongs in privileged governance.
👉 Read our full editorial: Authorization-focused identity security is now an insurability issue
This post was modified 3 hours ago by NHI Mgmt Group