Topic starter
11/08/2026 3:24 pm
TL;DR: Identity failures increasingly happen through valid logins and trusted integrations, not malware, with one OAuth token theft opening more than 700 Salesforce environments and another warehouse campaign reaching about 165 companies, according to Newcore. Identity policy now has to evaluate context, privilege, and application criticality at the decision point, because sign-in alone no longer expresses real risk.
Editorial analysis by NHI Mgmt Group, based on content published by Newcore: “Your Identity Management Must Have an Adaptive Security Spine”.
Key questions
Q: What breaks when identity checks focus only on sign-up verification?
A: Abuse shifts downstream.
Q: Why do trusted integrations create a larger breach risk than direct credential theft?
A: Trusted integrations often bypass the usual suspicion that follows direct credential theft because they are already authorised to act.
Q: What are the signs that a storage access policy is failing in practice?
A: Warning signs include shared URLs that grant broader permissions than users expect, long-lived tokens that remain valid indefinitely, and security alerts that are repeatedly dismissed as false positives.
Practitioner guidance
- Embed risk decisions in the access path Make the identity provider the enforcement point for allow, deny, and step-up decisions so policy can react before access is granted.
- Tie challenge strength to application criticality Use the value of the target application, the role being used, and the current environment to determine whether the session needs stronger proof.
- Review standing trust in SaaS integrations Inventory integrations, tokens, and delegated access that can reach customer, financial, or administrative data without fresh evaluation.
Bottom line: Valid credentials and trusted integrations now account for much of the practical breach path, so identity risk is less about breaking in than about abusing existing trust.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
11/08/2026 3:34 pm
Identity policy is now a runtime control, not a reporting layer: A policy that only records risk after sign-in is already too late for today’s credential-led attacks. Trusted tokens, delegated access, and long-lived sessions require the allow or deny decision to happen where access is actually consumed. The implication is that identity teams must stop treating policy as administrative metadata and treat it as an execution control.
A few things that frame the scale:
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should organisations prioritise in-path policy over posture scoring?
A: Yes, when the goal is to stop risky access rather than just document it. Posture scoring helps identify weak accounts and integrations, but only in-path policy can change the outcome at the moment of access. The right sequence is visibility first, enforcement in the access path second.
👉 Read our full editorial: Identity policy must move from logging in to controlling risk
This post was modified 4 days ago by NHI Mgmt Group