Topic starter
23/06/2026 9:14 pm
TL;DR: The 2026 Verizon DBIR ties 39% of breaches to credential abuse, 50% of ransomware victims to a prior infostealer or credential leak, and 67% of users to non-corporate AI accounts on corporate devices, exposing an identity observability gap according to AuthMind. The control failure is not just missing detection, but unseen identities that never enter governance, review, or response paths.
Editorial analysis by NHI Mgmt Group, based on content published by AuthMind: “The 2026 DBIR Just Described an Identity Observability Problem. Did You Notice?”.
Key questions
Q: What breaks when identity events are invisible to IAM and SOC teams?
A: When identity events are invisible, recertification, offboarding, and incident response all start from stale information.
Q: Why do credential leaks still lead to ransomware even after initial containment?
A: Credential leaks remain dangerous because they often persist as active access or reusable tokens after the first event is detected.
Q: How can security teams govern shadow AI accounts without losing control of identity risk?
A: Treat shadow AI as an unmanaged identity problem first.
Practitioner guidance
- Map unmanaged identity paths Inventory non-corporate AI accounts, shadow service accounts, and third-party identities that operate outside normal joiner-mover-leaver workflows.
- Correlate credential events to breach risk Link infostealer detections, leaked credential indicators, and unusual authentication patterns to the owning identity and business context so a credential event becomes an actionable security signal rather than an isolated alert.
- Review third-party privilege aging Track how long external accounts remain active after scope changes, contract changes, or remediation findings, and treat long-lived third-party privilege as a governance defect rather than an exception queue.
Bottom line: The central problem is not a lack of identity controls, but a lack of continuous visibility into the identities that are already active across human, third-party, and machine contexts.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 2:25 am
Identity observability is now a prerequisite for identity governance: recertification and offboarding cannot govern identities that never enter the inventory. The DBIR pattern across shadow AI, credential abuse, and third-party delay shows that visibility failure is the upstream control gap. The implication is that identity programmes must treat discovery and correlation as governance, not as a separate monitoring function.
A few things that frame the scale:
- The 2026 Verizon DBIR found that exploitation of software vulnerabilities became the leading initial access vector in confirmed breaches, accounting for 31% of incidents.
A question worth separating out:
Q: What should IAM teams prioritise when third-party access takes months to close?
A: They should prioritise ownership, active usage, and permission aging. If an external account remains active after a role, contract, or remediation change, it should be treated as a live governance defect. Long closure times usually mean the team lacks continuous visibility into who is still using what.
👉 Read our full editorial: Identity observability is the missing control in the 2026 DBIR