Notifications
Clear all
Topic starter
11/08/2026 3:14 pm
TL;DR: Identity abuse still appears in 39% of breaches, while only 26% of known exploited vulnerabilities were remediated last year and median patch time stretched to 43 days, according to Verizon DBIR and the source article. The practical lesson is that AI is compressing attacker timelines, not replacing the need for disciplined identity, visibility, and containment controls.
NHIMG editorial — based on content published by Illumio: The New ABCs of Cybersecurity: Identity, Visibility, and Containment
By the numbers:
- Identity abuse still appears in 39% of breaches when looking at the attack chain as a whole.
- Only 26% of known exploited vulnerabilities were remediated last year, down from 38% the year before.
- The median time to patch stretched from 32 days to 43 days.
Questions worth separating out
Q: How can organisations reduce credential abuse in cloud environments?
A: They should combine elimination, rotation, and scope control.
Q: Why do identity and visibility problems make AI-era attacks harder to contain?
A: Because AI compresses the time attackers need to find access paths, but it does not remove the need for those paths to exist.
Q: What breaks when organisations rely on patching without identity containment?
A: Patch programs reduce exploit opportunities, but they do not stop a threat actor who already has valid access.
Practitioner guidance
- Inventory identity and access paths from the outside in Run an external assessment of exposed systems, cloud surfaces, and identity entry points, then reconcile the result against your internal asset and account inventory.
- Map credential abuse to business-critical paths Identify where stolen passwords, reset flows, and reused credentials would provide the fastest route to sensitive systems or admin functions.
- Reduce the blast radius of every login Segment workloads, constrain service account reach, and remove broad internal trust assumptions so a single valid account cannot move across tiers unchecked.
What's in the full article
Illumio's full blog covers the operational detail this post intentionally leaves for the source:
- The full breakdown of the red-team and attacker economics examples that support the identity-first resilience argument
- The podcast-driven discussion of how specific help desk impersonation patterns change breach entry paths
- The deeper explanation of why containment policy between workloads changes the lateral movement problem
- The source article's broader framing of how AI accelerates attack timelines across the breach chain
👉 Read Illumio's analysis of identity, visibility, and containment in cyber resilience →
Identity, visibility, and containment: are your controls keeping up?
Explore further
11/08/2026 3:27 pm
Identity, visibility, and containment are now a single governance chain, not three separate initiatives. The article is right to frame these as the cyber resilience ABCs because each one compensates for the failure of the others. Identity without visibility creates blind trust, visibility without containment creates observation without control, and containment without identity discipline leaves the front door open. The practitioner conclusion is that programme ownership has to converge across IAM, PAM, and NHI governance.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to Ultimate Guide to NHIs.
- Another finding from the same research shows that 71% of NHIs are not rotated within recommended time frames, leaving stale access in place far longer than most teams assume.
A question worth separating out:
Q: Who is accountable when credential compromise leads to lateral movement?
A: Accountability usually spans identity, endpoint, and application owners, because the failure is rarely a single control. Governance should assign ownership for credential assurance, privileged access scope, and revocation speed so that no one assumes the other team will contain the blast radius.
👉 Read our full editorial: Identity, visibility, and containment now define cyber resilience
