Topic starter
02/06/2026 12:58 pm
TL;DR: March’s breach pattern showed that attackers are compromising trusted identities, not perimeter controls, and then using legitimate access to move downstream, according to Delinea Labs’ April 2026 Threat Outlook. The result is a governance problem, not just an authentication problem, because identity can become the weapon once trust is inherited across tenants, partners, and automation.
Editorial analysis by NHI Mgmt Group, based on content published by Delinea: “Identity supply chains are under siege”.
By the numbers:
- In March, 5,236 CVEs were disclosed across the industry, and 519 were identity-related.
- The article says 62 CVEs directly affected identity products.
- Tycoon 2FA accounted for 62% of all phishing attempts blocked by Microsoft by mid-2025.
Key questions
Q: What breaks when one trusted identity can unlock multiple downstream systems?
A: The control breaks at the trust boundary.
Q: What problem does ownership attribution solve for service accounts and API keys?
A: It closes the gap between exposure detection and accountable remediation.
Q: How do teams know whether trust inheritance is under control?
A: Look for whether every high-value boundary requires explicit reauthorisation, not just initial login success.
Practitioner guidance
- Map downstream trust paths Document which administrators, partners, cloud roles, and service accounts can open access in other environments without reproof of intent.
- Classify non-human identities by blast radius Group service accounts, API keys, and automation tokens by owner, expiry, and the systems they can reach so reused credentials can be removed from high-impact chains.
- Add execution-time checks for destructive actions Require a second governance decision for device wipes, policy changes, tenant-wide resets, and other irreversible operations instead of trusting the original session alone.
Bottom line: Attackers no longer need to break every control boundary when one trusted identity can open several downstream environments.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/06/2026 1:00 pm
Identity supply chains are now a governance problem, not just an authentication problem. The article shows that attackers often use valid credentials exactly as intended, which means the security failure sits in how trust is inherited across systems. That shifts the centre of gravity from login hardening to trust-path control. Practitioners should treat every downstream acceptance point as a governance boundary.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Who should own third-party identity access across vendors and BPOs?
A: Ownership should sit with the business and identity governance function together, because inherited access crosses operational and contractual lines. If no team can name the current purpose, scope, and expiry of a partner credential, accountability has already fractured. That is when downstream trust becomes an enterprise risk rather than a vendor issue.
👉 Read our full editorial: Identity supply chains are under siege as trust cascades downstream