Topic starter
06/07/2026 9:36 am
TL;DR: Identity-related security incidents have affected 96% of organisations, while 43.6% saw stolen credentials and 48.1% faced MFA fatigue attacks, underscoring how identity has become the main entry point for cyberattacks, according to Lumos. The real governance break is not visibility alone, but the fact that human IAM, NHI controls, and real-time detection are still being operated as separate problems rather than one identity security system.
Editorial analysis by NHI Mgmt Group, based on content published by Lumos: “New Research Finds Identity has Become the Most Common Entry Point for Cyberattacks”.
By the numbers:
- 96% of organisations have experienced identity-related security incidents.
- 43.6% of organisations reported the use of stolen credentials.
- 48.1% of organisations experienced a Multi-Factor Authentication fatigue attack.
Key questions
Q: What breaks when identity controls are split across human, NHI and detection teams?
A: Attackers exploit the seams between ownership, review and telemetry.
Q: Why do stolen credentials and MFA fatigue attacks keep working in mature environments?
A: They work because authentication success is often treated as the end of the control, not the beginning of identity oversight.
Q: How can security teams tell whether NHI governance is working?
A: They should look for fewer orphaned accounts, shorter credential lifetimes, lower secret reuse and faster decommissioning when systems or projects end.
Practitioner guidance
- Consolidate identity ownership into one control model Map human users, service accounts, tokens and future AI-driven identities into a single inventory with named owners, business purpose, privilege scope and review cadence so control gaps do not sit between teams.
- Prioritise dormant access and service account cleanup Review dormant accounts, unused entitlements and service account permissions first, because the article shows these are the easiest places for attackers to find unmonitored access paths.
- Measure identity misuse in real time Set operational targets for mean time to detect and mean time to provision so suspicious privilege use is visible while the session is still active, not after audit.
Bottom line: Identity incidents increasingly succeed because attackers can move through legitimate identity paths rather than needing novel exploits.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/07/2026 9:51 am
Identity has become the organising layer of enterprise attack paths: The article confirms that adversaries now treat identity as the shortest route into cloud, SaaS and internal systems. That changes the security conversation from perimeter defence to identity control consistency across human accounts, service accounts and emerging automated actors. For practitioners, the lesson is that fragmented ownership of identity controls creates exploitable seams.
A few things that frame the scale:
- 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments, according to the 2026 Infrastructure Identity Survey.
- 88% of organisations have embedded AI agents in their workflows, according to KPMG's 2026 report.
A question worth separating out:
Q: When should organisations prioritise identity attack surface visibility over more reviews?
A: They should prioritise visibility when reviews are repeatedly certifying stale state. If access changes faster than recertification can reflect it, more reviews add paperwork but not control. Continuous exposure visibility is the prerequisite for deciding which identities, paths, and privileges are actually worth certifying.
👉 Read our full editorial: Identity incidents now dominate cyberattacks, with NHIs in the blind spot