Topic starter
24/06/2026 9:25 pm
TL;DR: Opal Security argues that 75% of security incidents stemmed from human errors tied to access privileges and identity mismanagement, with examples ranging from revoked access failures to missing MFA and over-privileged accounts across Cash App, Change Healthcare, CircleCI, Deloitte, Microsoft, and Snowflake. Breach containment depends on lifecycle governance, not just perimeter defence, because standing access turns small entry points into broad compromise.
Editorial analysis by NHI Mgmt Group, based on content published by Opal Security: “Six Degrees of Identity Security Issues”.
By the numbers:
- The global average cost of a data breach last year was $4.45 million.
- 75% of security incidents were caused by bad actors taking advantage of human errors tied to access privileges and identity mismanagement.
Key questions
Q: What breaks when access revocation is delayed after termination?
A: Delayed revocation leaves a former employee, contractor, or partner with a valid path into systems that should already be closed.
Q: Why do missing MFA and excessive privileges make breaches worse?
A: Missing MFA makes stolen or guessed credentials easier to use, while excessive privileges decide how far the attacker can move once inside.
Q: How do you know whether privileged access governance is actually working?
A: Look for reduced standing assignments, shorter activation periods aligned to task duration, and access reviews that routinely remove unused eligibility.
Practitioner guidance
- Enforce event-driven offboarding Connect HR, contractor, and vendor departure signals to automatic revocation across directories, SaaS, cloud roles, and privileged pathways so access ends when the trust relationship ends.
- Require MFA on every critical system Eliminate exceptions for acquired environments, legacy platforms, and production tools by making MFA mandatory wherever identity can reach sensitive data or administrative functions.
- Reduce standing privilege before incidents do Replace always-on elevated access with JIT grants for production, admin, and sensitive support workflows so compromise does not inherit broad access by default.
Bottom line: Identity failures, not only perimeter failures, repeatedly created the conditions for the breaches discussed in the source article.
What's in the full article
Opal Security's full article covers the incident-by-incident identity failure patterns this post intentionally leaves at the analysis level:
- Cash App, Change Healthcare, CircleCI, Deloitte, Microsoft, and Snowflake as separate identity failure case studies
- The specific role of revoked access, missing MFA, and over-privileged accounts in each incident
- How least privilege and JIT access change breach impact when identity compromise already exists
- The vendor's recommended security posture changes for teams trying to reduce identity-related breach exposure
👉 Read Opal Security's analysis of identity failures behind major breaches →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 6:38 am
Identity mismanagement is a breach containment failure, not an administrative inconvenience. The article’s central pattern is that attackers repeatedly exploit access that should have expired, been narrowed, or been challenged with stronger authentication. That means IAM, IGA, and PAM are not back-office controls; they are part of incident prevention and blast-radius reduction.
A question worth separating out:
Q: When does just-in-time access make more sense than permanent admin rights?
A: JIT access makes the most sense when elevated rights are needed for specific tasks rather than continuous operation. It reduces standing exposure, limits the value of stolen credentials, and makes reviews easier. If your teams cannot justify persistent admin access, it is usually a sign the role is too broad.
👉 Read our full editorial: Six degrees of identity security issues in enterprise breaches