Notifications
Clear all
Topic starter
21/08/2026 4:42 pm
TL;DR: Identity attacks in 2026 increasingly succeed through valid credentials, trusted sessions, and malware-free paths, and Unosecur argues that five-minute MTTD is now the practical benchmark for interrupting abuse before privilege escalation and lateral movement progress. The key assumption collapsing is that post-authentication activity remains reviewable long enough for conventional SOC cycles to catch it.
NHIMG editorial — based on content published by Unosecur: Identity threat detection in 2026: Why 5-minute MTTD is now the benchmark
By the numbers:
- CrowdStrike found that 82% of detections in 2025 were malware-free, showing how often attackers now operate through valid identity paths.
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases.
Questions worth separating out
Q: How should security teams detect stolen credential use after authentication succeeds?
A: They should monitor what the identity does after login, not only whether login succeeded.
Q: Why does identity threat detection need to be measured in minutes?
A: Because identity abuse through trusted credentials can progress very quickly once a session is established.
Q: What breaks when SOC teams rely on SIEM alone for identity abuse detection?
A: They usually get broad event visibility without enough identity context to decide whether activity is malicious.
Practitioner guidance
- Instrument post-authentication behaviour monitoring Track session activity, privilege changes, resource access, and token use after authentication so the SOC can distinguish valid login from malicious identity behaviour.
- Set identity-specific detection and containment targets Define MTTD and MTTR by identity attack type, such as token misuse, privilege escalation, or SaaS session abuse, and tie each to approved containment actions.
- Unify identity context before analysts need it Connect IdP, cloud, SaaS, entitlement, and response tooling into a common identity graph so investigators can see access relationships and execute containment without manual correlation.
What's in the full article
Unosecur's full article covers the operational detail this post intentionally leaves for the source:
- Its identity threat detection architecture for correlating authentication, privilege, session, and behaviour signals across environments.
- Its explanation of how the Unified Identity Fabric joins users, roles, service accounts, keys, entitlements, and AI agents into one graph.
- Its containment workflow examples for session revocation, access-token invalidation, privilege rollback, and key rotation.
- Its discussion of how ITDR and SIEM work together in the SOC rather than serving the same purpose.
👉 Read Unosecur's analysis of why five-minute MTTD is now the ITDR benchmark →
Identity threat detection at five minutes: are controls keeping up?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
21/08/2026 5:03 pm
Five-minute identity detection is a response architecture benchmark, not a SOC vanity metric. The article is right to frame MTTD and MTTR as the relevant measures because identity attacks now move through trusted access paths rather than noisy malware events. When detection is slow, the breach is already inside the privilege boundary. Practitioners should treat the five-minute target as a design requirement for identity monitoring, enrichment, and containment.
A few things that frame the scale:
- 79% of organisations have experienced secrets leaks, with 77% of these incidents resulting in tangible damage, according to the Ultimate Guide to NHIs.
- 71% of NHIs are not rotated within recommended time frames, which helps explain why exposed credentials remain exploitable long after discovery.
A question worth separating out:
Q: Who is accountable when identity threats are contained by session revocation or token invalidation?
A: Accountability sits across IAM, SOC, and platform owners because containment changes access state and can affect business continuity. Organisations should predefine who can approve identity containment, who preserves evidence, and which frameworks govern the response. Without that, fast action becomes inconsistent and hard to audit.
👉 Read our full editorial: Identity threat detection now depends on five-minute MTTD
