Topic starter
12/07/2026 12:21 pm
TL;DR: Identity-related breaches accelerated in 2022, with IDSA reporting that 84% of respondents experienced one and 96% said identity-focused solutions could have reduced the impact, according to SentinelOne and IDSA research. The practical lesson is that IAM, PAM, and IGA now need detection, telemetry, and response layered around them, not treated as standalone protection.
Editorial analysis by NHI Mgmt Group, based on content published by SentinelOne: “ITDR For the Win | Moving Beyond IAM and PAM to Protect Digital Identities”.
By the numbers:
- 84% of respondents experienced an identity-related breach in the past year, according to SentinelOne and IDSA research cited by SentinelOne.
- 96% reported that those breaches could have been minimized or even prevented by identity-focused solutions, according to SentinelOne and IDSA research cited by SentinelOne.
- 78% reported direct business impacts such as reputational damage and the cost of recovery post-breach, according to SentinelOne and IDSA research cited by SentinelOne.
Key questions
Q: How should security teams find the identities that traditional IAM tools miss?
A: Use continuous discovery across cloud, SaaS, on-premises, and directory sources, then correlate each identity with ownership, entitlements, and last activity.
Q: Why do valid credentials still create breach risk when access is already approved?
A: Because approval proves only that access was granted, not that it was used safely.
Q: What are the signs that identity protections are failing in practice?
A: Common warning signs include repeated phishing success, help desk credential resets that lead to account takeover, exposed access keys, misconfigured identity providers, and weak visibility into privileged accounts.
Practitioner guidance
- Build identity telemetry into existing governance workflows Correlate authentication, privilege, and directory events so misuse is visible alongside provisioning and recertification activity.
- Prioritise detection for credential abuse paths Hunt for phishing, stuffing, and support-account abuse that can turn valid access into privilege escalation across endpoint, cloud, and AD.
- Reduce cloud entitlement sprawl Review risky cloud entitlements that can be used to move laterally or reset access, especially where permissions are broad or persistent.
Bottom line: Identity security is no longer solved by access administration alone because attackers can abuse valid credentials after IAM has done its job.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
12/07/2026 12:35 pm
ITDR is the missing runtime layer in identity governance: IAM, PAM, and IGA decide entitlements, but they do not continuously observe how those entitlements are being abused. That leaves a blind spot between approved access and malicious use, especially when attackers operate with valid credentials. The discipline is shifting from access administration alone to identity behaviour detection, and practitioners should treat that as a control gap, not a tuning issue.
A few things that frame the scale:
- 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
- 49% of IT professionals would prioritise improving privileged access management if the decision were theirs alone, according to Netwrix's 2023 Hybrid Security Trends Report.
A question worth separating out:
Q: How should security teams respond when a trusted identity is suspected of being compromised?
A: Security teams should treat the alert as a containment event, not a routine ticket. The first move is to validate the signal, then revoke access quickly enough to stop lateral movement. In higher-risk cases, disable all accounts tied to the identity, isolate affected systems, and move to controlled recovery. The key is speed, policy-based automation, and clear escalation paths before an attacker expands reach.
👉 Read our full editorial: Identity threat detection and response is filling IAM blind spots