Notifications
Clear all
Topic starter
12/06/2026 9:40 pm
TL;DR: 38% of U.S. enterprise security and IT leaders have suffered an identity-related incident with measurable financial or operational impact, while 41% still lack a defensible dollar estimate of exposure, according to Axiad’s survey of 312 leaders. The gap is not visibility alone, but the inability to translate identity risk into prioritised action fast enough to matter.
NHIMG editorial — based on content published by Axiad: Blind Spots, a research report on identity risk blind spots
By the numbers:
- 38% of security leaders have experienced an identity-related incident with measurable financial or operational impact.
- 43% said they could assess the full blast radius of a compromised, high-privilege account within minutes.
Questions worth separating out
Q: What breaks when identity risk can be seen but not quantified?
A: When identity risk is visible but not quantifiable, security teams can identify problems without proving which ones matter most.
Q: Why do identity blind spots create so much operational risk in enterprises?
A: Identity blind spots create operational risk because compromise often spreads through privileged access, connected systems, and trusted automation before teams can assess the impact.
Q: How do security teams know whether identity risk controls are actually working?
A: Identity risk controls are working only if they shorten the time from alert to impact assessment and produce a defensible prioritisation order.
Practitioner guidance
- Map identity blast radius to critical business services Build a dependency view that shows which applications, data sets, and privileged paths each high-risk identity can reach, then test whether that view can be produced in minutes rather than hours.
- Attach a defensible dollar estimate to the highest-risk identities Use a repeatable method to estimate the financial impact of compromise for privileged users, service accounts, and shared credentials, then update the model when access scope changes.
- Rank findings by containment value, not alert count Replace raw volume reporting with a queue that sorts identity issues by likely business impact, exposure duration, and privilege level.
What's in the full report
Axiad's full report covers the operational detail this post intentionally leaves for the source:
- The survey methodology and sample breakdown across 312 senior security and IT leaders.
- The full distribution of responses on visibility, prioritisation, and monetary quantification of identity risk.
- More detail on how respondents described the barriers to turning identity findings into funded remediation.
- The report's broader findings on AI-driven discovery pressure and prioritisation strain.
👉 Read Axiad's survey findings on identity risk blind spots and quantified exposure →
Identity risk blind spots: what practitioners need to act on?
Explore further
12/06/2026 11:55 pm
Identity visibility without decision speed is a governance mirage. This survey shows that many organisations can claim near real-time visibility while still being unable to size the blast radius of a compromised high-privilege account within minutes. That is not an observability problem in the abstract, it is a governance failure because exposure has no practical meaning until it can be acted on. The practitioner conclusion is straightforward: visibility metrics are only credible when they shorten containment decisions.
A few things that frame the scale:
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, according to The 2024 ESG Report: Managing Non-Human Identities.
- Two-thirds of enterprises have endured a successful cyberattack resulting from compromised non-human identities, with a quarter encountering multiple attacks.
A question worth separating out:
Q: Who is accountable when identity risk causes measurable business impact?
A: Accountability sits with the teams that own identity governance, privileged access, and security risk decisions, not with the alerting tool alone. Organisations should define who can translate identity findings into financial exposure, who approves remediation, and who is responsible for containment when a privileged identity is compromised.
👉 Read our full editorial: Identity risk blind spots are costing security teams time and money
