Topic starter
02/06/2026 12:58 pm
TL;DR: Attackers compromised trusted identities and moved downstream through legitimate access, Delinea Labs reports in its April 2026 Threat Outlook. Downstream trust paths now need fresh authorization at each high-value boundary, or one upstream account can reach tenants, partners, and automation.
Editorial analysis by NHI Mgmt Group, based on content published by Delinea: “Identity supply chains are under siege”.
By the numbers:
- In March, 5,236 CVEs were disclosed across the industry, and 519 were identity-related.
- The article says 62 CVEs directly affected identity products.
- Tycoon 2FA accounted for 62% of all phishing attempts blocked by Microsoft by mid-2025.
Key questions
Q: What problem does ownership attribution solve for service accounts and API keys?
A: It closes the gap between exposure detection and accountable remediation.
Q: How do teams know whether trust inheritance is under control?
A: Look for whether every high-value boundary requires explicit reauthorisation, not just initial login success.
Q: What breaks when one trusted identity can unlock multiple downstream systems?
A: The control breaks at the trust boundary.
Practitioner guidance
- Map downstream trust paths Document which administrators, partners, cloud roles, and service accounts can open access in other environments without reproof of intent.
- Classify non-human identities by blast radius Group service accounts, API keys, and automation tokens by owner, expiry, and the systems they can reach so reused credentials can be removed from high-impact chains.
- Add execution-time checks for destructive actions Require a second governance decision for device wipes, policy changes, tenant-wide resets, and other irreversible operations instead of trusting the original session alone.
Bottom line: Attackers no longer need to break every control boundary when one trusted identity can open several downstream environments.
Glossary terms: Identity supply chain, Downstream Trust Path, Execution-Time Authorization, Trust debt
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 hours ago by NHI Mgmt Group
02/06/2026 1:00 pm
Identity supply chains are now a governance problem, not just an authentication problem. The article shows that attackers often use valid credentials exactly as intended, which means the security failure sits in how trust is inherited across systems. That shifts the centre of gravity from login hardening to trust-path control. Practitioners should treat every downstream acceptance point as a governance boundary.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Who should own third-party identity access across vendors and BPOs?
A: Ownership should sit with the business and identity governance function together, because inherited access crosses operational and contractual lines. If no team can name the current purpose, scope, and expiry of a partner credential, accountability has already fractured. That is when downstream trust becomes an enterprise risk rather than a vendor issue.
👉 Read our full editorial: Identity supply chains are under siege as trust cascades downstream