Topic starter
22/07/2026 4:38 pm
TL;DR: More than $18.5 billion in identity security spend in 2024 has not prevented account compromise from remaining attackers’ most common entry point, according to Silverfort, while over 800 million new stolen credential sets surfaced this year amid infostealer-driven exposure. The model has to move from reactive identity cleanup to enforceable, default-deny control before compromise.
Editorial analysis by NHI Mgmt Group, based on content published by Silverfort: “Towards identity security v2: Winning the account compromise battle”.
By the numbers:
- identity security products in 2024, a 15% increase year over year according to Gartner
- over 800 million new sets of stolen credentials compromised as a result of the explosion of infostealers
Key questions
Q: What breaks when identity security stays reactive after compromise?
A: Reactive identity security breaks when organisations treat compromise as the point where work begins.
Q: Why do stolen credentials remain such an effective attack path?
A: Stolen credentials work because many systems still treat a successful login as enough evidence of legitimacy.
Q: How can security teams know whether identity controls are actually reducing breach impact?
A: Look for evidence that suspicious accounts are contained fast, active sessions are terminated, and privileged access is limited to the smallest possible set of systems.
Practitioner guidance
- Define pre-compromise control points Map where identity decisions can be blocked before valid credentials are accepted, especially for sensitive infrastructure and privileged access paths.
- Enforce default-deny access rules Require explicit policy approval for sensitive authentication paths, and deny legacy or untrusted access routes by default.
- Constrain service account behaviour Limit service accounts to approved runtime behaviour so machine identities cannot drift into broader access than their intended function.
Bottom line: The article argues that account compromise persists because identity security is still organised around reactive cleanup rather than preventive control.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 5 days ago by NHI Mgmt Group
24/07/2026 4:11 pm
Identity Security v1 is built around cleanup, not containment. The article describes a legacy model that treats identity as compliance support and business enablement, then layers controls over already exposed environments. That approach assumes security can keep up after compromise, which is exactly the assumption attackers exploit. The implication is that identity governance has to be rebuilt as a control function, not a post-exposure remediation queue.
A question worth separating out:
Q: What is the difference between identity operations and identity security?
A: Identity operations focuses on keeping access available, onboarded, and compliant. Identity security focuses on preventing compromise, constraining blast radius, and enforcing access decisions in real time. The practical difference is that operations asks whether users can log in, while security asks which logins should never be allowed.
👉 Read our full editorial: Identity security v2 means control before compromise, not after
This post was modified 5 days ago by NHI Mgmt Group