Notifications
Clear all
08/06/2026 9:16 am
Identity trust is the real perimeter, and this campaign proves legacy authentication still collapses first. Password spraying, phishing, and malware do not need to defeat a mature network boundary if the identity layer remains permissive. NTLM, weak mailbox permissions, and replayable credentials turn authentication into a pathway rather than a gate. The practical conclusion is that identity hardening is now front-line defence, not a supporting control.
A few things that frame the scale:
- 79% of organisations have experienced secrets leaks, with 77% of these incidents resulting in tangible damage, according to Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, which is why identity trust failures often persist unseen until an incident forces discovery.
A question worth separating out:
Q: Who is accountable when identity trust failures enable espionage campaigns?
A: Accountability sits with the teams that own authentication policy, legacy protocol retirement, mailbox governance, and privileged access design. In practice, that means IAM, security architecture, and platform owners must share responsibility for removing weak trust paths before attackers use them.
👉 Read our full editorial: PKI authentication and NTLM deprecation define the identity risk gap
