Notifications
Clear all
Topic starter
14/08/2026 6:34 pm
TL;DR: Identity weaknesses played a material role in nearly 90% of incidents and accounted for 65% of initial access in Palo Alto Networks Unit 42’s 2026 Global Incident Response Report. Misconfigurations matter because they turn legitimate access into expanded attack paths that MFA alone cannot fix.
NHIMG editorial — based on content published by Unosecur: Identity system misconfigurations: How small access mistakes become attack paths
By the numbers:
- identity-based techniques accounted for 65% of initial access.
Questions worth separating out
Q: How should security teams reduce the blast radius of privileged identities?
A: Security teams should define a small set of tightly governed admin identities, give them the minimum authority needed, and make elevation time bound.
Q: Why do machine identities create risk even when MFA is enabled?
A: Machine identities create risk because MFA only verifies access at one moment, while the underlying credential, certificate, or token may remain reusable for far longer.
Q: Why do periodic access reviews fail as the main governance control?
A: Because they assume access can remain in place until the next review without creating meaningful risk.
Practitioner guidance
- Map effective access paths for high-risk identities Trace how a user, service account, or workload can combine roles, group membership, and trust relationships to reach privileged resources.
- Remove temporary access at task completion Tie elevated access removal to the end of the work, not to the next scheduled review.
- Review privilege creep as a separate risk category Do not collapse all excess access into a generic entitlement backlog.
What's in the full article
Unosecur's full article covers the operational detail this post intentionally leaves for the source:
- Examples of IAM misconfiguration patterns across human users, service accounts, and cloud policies
- The article’s access-review framing for effective privilege, including how to evaluate actual reach rather than role labels
- The vendor’s explanation of how its Unified Identity Fabric connects discovery, analysis, and remediation across identity types
👉 Read Unosecur’s analysis of how identity misconfigurations create attack paths →
Identity misconfigurations: are your controls limiting blast radius?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
14/08/2026 6:41 pm
Identity misconfiguration is really a blast-radius problem. The article correctly shifts attention away from whether an identity exists and toward what that identity can do if compromised. That is the decisive question for both human and non-human identities, because valid access can still be dangerous when it reaches policy, secrets, or production control paths. Practitioners should treat attack reach as the core governance object.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to Ultimate Guide to NHIs.
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
A question worth separating out:
Q: Who is accountable when privileged access is not removed on time?
A: Accountability should sit with the business owner of the role, the system owner, and the identity governance process that approved and failed to remove the access. In regulated environments, delayed removal is not just a technical issue. It is a control failure that can undermine auditability and compliance evidence.
👉 Read our full editorial: Identity system misconfigurations expand attack paths beyond initial access
