Topic starter
25/08/2026 6:11 pm
TL;DR: Ransomware is increasingly an identity problem rather than a pure malware problem, with 83% of attacks compromising identity infrastructure and 30% of intrusions using identity-based tactics, according to Veza, Semperis and IBM X-Force. That shifts the control point from endpoint response to visibility, entitlement governance, and non-human identity oversight.
Editorial analysis by NHI Mgmt Group, based on content published by Veza: “Ransomware Isn’t Just Malware Anymore – It’s an Identity Problem”.
Key questions
Q: What breaks when identity visibility is missing during a ransomware attack?
A: Containment becomes guesswork.
Q: Why do valid accounts make ransomware attacks harder to detect?
A: Valid accounts blend into normal access patterns, especially when they are purchased or stolen through initial access brokers.
Q: How can security teams tell whether entitlement governance is actually reducing ransomware risk?
A: They should look for fewer dormant accounts, fewer unmanaged service identities, and fewer toxic access combinations that could reach backup, admin, or data systems.
Practitioner guidance
- Map the full identity estate Inventory human accounts, service accounts, workloads, tokens, and orphaned identities in one governance view so hidden access is not missed during incident response.
- Remove unmanaged and orphaned access Identify identities with no clear owner, no current business purpose, or no recent governance review, then revoke or rehome them before attackers can abuse them.
- Review toxic privilege combinations Find identities that can both change systems and access backups, administrative tools, or sensitive data stores, then separate those rights where possible.
Bottom line: Ransomware increasingly succeeds by abusing legitimate identity infrastructure rather than by relying solely on novel malware.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/08/2026 6:11 pm
Identity security posture management is becoming the governing layer for ransomware defense. Endpoint tools can detect malicious activity, but they cannot explain why a user, service account, or workload had the rights to execute it in the first place. When identity sprawl is the real exposure, the security question shifts to access legitimacy, entitlement scope, and ownership. The practitioner conclusion is that ransomware defense now depends on governing the identity plane as a first-class control surface.
A question worth separating out:
Q: Should organisations prioritise ISPM before more endpoint controls for ransomware defense?
A: If identity sprawl is the main exposure, ISPM should be prioritised alongside endpoint controls because it addresses the access conditions that ransomware repeatedly exploits. EDR can detect execution, but it cannot answer why an identity had the right to act. The decision point is whether hidden access is a bigger gap than detection coverage.
👉 Read our full editorial: Identity security posture management is now central to ransomware defense