Topic starter
08/06/2026 4:04 pm
TL;DR: Identity security reports show 97% of organisations are challenged by identity verification, only 45% use MFA, and 93% reported two or more identity-related breaches in the last year, according to Axiad. The pattern is clear: identity risk is now a core security problem, not an operational side issue.
Editorial analysis by NHI Mgmt Group, based on content published by Axiad: “A Wave of Identity Security Reports Defines a Big Problem”.
By the numbers:
- 97% of organizations are challenged by identity verification, according to Axiad.
- Only 45% are using multifactor authentication to verify the identity of users, according to Axiad.
- 93% of organizations had two or more identity-related breaches in the last year, according to Axiad.
Key questions
Q: What breaks when identity verification is weak in non-face-to-face business relations?
A: Weak verification allows higher fraud risk, poor customer risk classification, and inconsistent due diligence.
Q: Why do overprivileged NHIs create more breach risk than limited ones?
A: Overprivileged NHIs enlarge the attack path because every additional permission becomes an option for escalation or data access.
Q: What are the signs that identity governance is not working in practice?
A: Common warning signs are repeated access workarounds, ignored approval workflows, super admins holding too much power, and teams bypassing the process because it is too slow or hard to use.
Practitioner guidance
- Strengthen phishing-resistant verification Replace weak or easily bypassed MFA paths for high-risk user access, especially where phishing and credential replay are realistic threats.
- Review NHI privilege scope Inventory service accounts, tokens, and other NHIs, then remove permissions that are not required for the current task or relationship.
- Treat identity as a breach surface Bring identity-related incidents into the same governance review cadence as endpoint and cloud incidents, with explicit ownership for remediation tracking.
Bottom line: Identity security remains a governance problem because verification, privilege scope, and breach frequency are all deteriorating at once.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
08/06/2026 5:29 pm
Identity verification has become a security control failure, not an authentication preference. The article's synthesis shows that 97% of organisations are challenged by identity verification, while only 45% use MFA. That gap tells us many programmes are still optimised for access convenience rather than assurance, and phishing-resistant authentication remains the dividing line between symbolic control and meaningful control. Practitioners should treat identity verification as a frontline defence requirement, not a user experience trade-off.
A question worth separating out:
Q: Who should own identity discovery when IAM, PAM, and NHI teams overlap?
A: Ownership should sit with the team that can unify identity data and drive remediation across domains, usually under identity security or IGA leadership. IAM, PAM, and NHI specialists all contribute, but discovery fails when each team only governs its own tooling instead of one common identity plane.
👉 Read our full editorial: Identity risk reports show why identity security is still failing
This post was modified 4 days ago by NHI Mgmt Group