Topic starter
01/08/2026 9:01 pm
TL;DR: Hybrid identity risk now spans Active Directory, cloud, credentials, NHIs and AI agents, creating attack paths that siloed tools miss because they do not map how exposures connect across environments, according to XM Cyber. The core issue is not isolated misconfigurations but linked identity pathways that let attackers move from one weak point to the next.
Editorial analysis by NHI Mgmt Group, based on content published by XM Cyber: “Identity Is the Highway. Here’s How Attackers Use It.”.
Key questions
Q: How should security teams handle identity exposures that span Active Directory and cloud?
A: Treat them as one attack surface, not two separate problems.
Q: Why do reused credentials and cached secrets create such high identity risk?
A: Because they let attackers use legitimate identity material instead of noisy exploits.
A: The main failure is that certification and lifecycle controls assume a stable identity with a human-style ownership model.
Practitioner guidance
- Map identity exposures as attack paths Build a view that links Active Directory, cloud accounts, NHIs and AI accounts so teams can see where one identity weakness leads to another.
- Inventory NHIs and AI accounts with ownership Record who owns each non-human or AI identity, what it can access and when it should be reviewed or removed.
- Hunt for reusable credential pathways Search for reused passwords, cached secrets and other identity material that lets an attacker pivot between environments.
Bottom line: Hybrid identity exposure becomes dangerous when separate credentials, permissions and environments connect into a usable attack path.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
01/08/2026 9:07 pm
Cross-environment identity exposure is now the real attack surface: The central problem is not that individual systems are misconfigured, but that identity risk now travels between them. A directory credential, a cached secret and a cloud permission only become dangerous when security teams fail to model the path that links them. Practitioners should treat identity as a connected estate, not a collection of separate tools.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How do teams decide which identity exposure to fix first?
A: Prioritise exposures that are validated on a route to business-critical assets, even if they are not the loudest findings. A low-severity issue that sits on a reachable attack path can matter more than a severe issue with no practical connection to impact. Path context is the deciding factor.
👉 Read our full editorial: Identity exposure management for hybrid, cloud and AI accounts