Topic starter
11/08/2026 3:14 pm
TL;DR: Stolen credentials still appear in 39% of breaches, only 26% of known exploited vulnerabilities were remediated last year, and median patch time stretched to 43 days, according to Illumio, showing that AI is compressing attacker timelines faster than defenders can close identity, visibility, and containment gaps. The governing assumption that organisations can patch and observe their way out of exposure is breaking down.
Editorial analysis by NHI Mgmt Group, based on content published by Illumio: “The New ABCs of Cybersecurity: Identity, Visibility, and Containment”.
Key questions
Q: What should teams do first when identity abuse is the most likely entry path?
A: Start by hardening the access paths attackers most often exploit, especially help-desk resets, SSO recovery, and privileged account authentication.
A: Because exploitation and identity abuse usually work together.
Q: What breaks when organisations can see assets but not identity reachability?
A: They end up with inventory without defensible awareness.
Practitioner guidance
- Strengthen identity proofing at the highest-risk access points Focus on privileged accounts, help-desk reset flows, and SSO recovery paths where attackers most often convert social engineering into legitimate access.
- Map exposed identities and forgotten systems from the outside in Use attacker-style discovery to identify reachable services, shadow assets, and service accounts that are missing from your internal picture.
- Reduce blast radius between workloads and business zones Apply segmentation and policy boundaries so a single compromised identity cannot move freely into adjacent systems.
Bottom line: Identity compromise remains a primary intrusion path because legitimate access is quieter and easier to expand than custom exploitation.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/08/2026 3:27 pm
Identity has become the shortest path because attackers increasingly prefer legitimate access over technical break-in. That is not a new problem, but it is now the dominant one because stolen credentials and help-desk manipulation scale faster than exploit development. In practice, identity governance is no longer a perimeter discipline. It is the first control plane attackers try to occupy.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- By 2029, 40% of enterprises that successfully implement zero trust within cloud service provider environments will rely on the advanced visibility and control capabilities offered by CNAPP solutions.
A question worth separating out:
Q: How should security teams balance detection, segmentation, and remediation?
A: Segmentation should be the control that limits the blast radius while detection and remediation work to find and fix the root cause. If remediation is slow, containment becomes the control that keeps one incident from becoming many. That makes movement restriction a core resilience decision, not a network design preference.
👉 Read our full editorial: Identity, visibility, and containment now define cyber resilience