Topic starter
11/07/2026 8:42 pm
TL;DR: Internal chats, emails, tickets, APIs, and workflows can still be impersonated without cryptographic identity validation, according to eMudhra. Communication integrity now has to be verified after login if approvals and requests are to be trusted.
Editorial analysis by NHI Mgmt Group, based on content published by eMudhra: “Identity Management in Communication: The Dark Hole No One Monitors”.
Key questions
Q: Why do login and MFA not stop communication-layer identity attacks?
A: Because login proves an initial session, not that each email, chat message, ticket, approval, or API call really came from the claimed identity.
Q: How should security teams validate approvals and privileged requests?
A: They should require cryptographic proof for high-risk communications, especially approvals that can move money, change access, or trigger operational actions.
Q: What breaks when organisations trust internal messages after login?
A: They create a trust gap where authenticated users, compromised sessions, or spoofed systems can issue believable requests that never get cryptographically re-checked.
Practitioner guidance
- Map communication channels as identity surfaces Inventory chats, email, ticketing, approval workflows, collaboration tools, and APIs as places where identity must be proven, not assumed.
- Require cryptographic validation for approvals Use signed requests, certificate-backed tokens, and tamper-evident workflow actions for privileged approvals and high-risk transactions.
- Separate authenticated access from trusted action Treat session validity as insufficient evidence for downstream requests unless the message, device, or service identity is re-verified.
Bottom line: Identity security weakens when organisations stop verifying once the user is inside the system and start assuming internal communication is trustworthy.
Glossary terms: Communication Integrity, Identity-Aware Messaging, Access Provenance, Communication-layer identity
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 3 days ago by NHI Mgmt Group
11/07/2026 9:11 pm
Communication integrity is the missing trust boundary in modern IAM. Most identity programmes still measure success at authentication, provisioning, and deprovisioning, then assume trust persists inside the session. That assumption fails in collaboration tools, approval chains, and API-driven workflows where the content of the request is never cryptographically bound to the claimed identity. Practitioners should treat the communication layer as an identity control surface, not a convenience channel.
A few things that frame the scale:
- 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
- Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.
A question worth separating out:
Q: What is the difference between authenticating a user and verifying a message?
A: Authentication confirms a subject at a point in time, while message verification confirms that a specific request, approval, or action still originated from the claimed identity and was not altered in transit or replayed. In modern enterprises, both are needed because the attack often happens after sign-in.
👉 Read our full editorial: Identity management in communication is the new trust boundary