Notifications
Clear all
Topic starter
22/07/2026 4:34 pm
TL;DR: Megakorp’s MVC strategy shows that resilience starts before recovery, with continuous visibility into misconfigurations, excessive privilege, and identity changes across Active Directory and Entra ID, according to Semperis. The lesson is that identity posture, not backup alone, determines how quickly organisations can contain disruption and reverse unsafe changes.
NHIMG editorial — based on content published by Semperis: Strengthening the MVC core: Principles for controlling security posture
By the numbers:
- Only 5.7% of organisations have full visibility into their service accounts.
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface.
- 71% of NHIs are not rotated within recommended time frames, increasing the risk of compromise over time.
Questions worth separating out
Q: How should teams reduce identity-related blast radius before a crisis happens?
A: Teams should treat identity posture as a live control problem, not a recovery exercise.
Q: Why do identity misconfigurations create resilience problems so quickly?
A: Because identity systems control access, administration, and downstream operational services at once.
Q: What do security teams get wrong about identity threat detection and response?
A: They often treat ITDR as a substitute for IAM, when it is actually complementary.
Practitioner guidance
- Instrument identity change monitoring Track who changed privileged objects, group memberships, tiering units, and lifecycle workflows across Active Directory and Entra ID, including in disconnected segments.
- Define rollback-worthy identity events Classify the changes that must trigger automated reversion or escalation, such as unauthorised OU edits, tiering changes, or account creation outside approved Identity Lifecycle Management.
- Map exposure paths to remediation tiers Separate immediate containment items from longer-term legacy cleanup so that excessive privilege and risky identity relationships are prioritised by business impact, not by discovery order.
What's in the full article
Semperis' full blog post covers the operational detail this post intentionally leaves for the source:
- The specific Directory Services Protector rule patterns used to detect and revert unsafe identity changes.
- The practical breakdown of visibility across connected and isolated networks in hybrid identity environments.
- The examples of how automated change monitoring supports OT and IT teams under restricted-network conditions.
- The remediation approach for mapping newly discovered exposure paths to short-, medium-, and long-term action plans.
👉 Read Semperis' analysis of identity visibility, control, and operational resilience →
Identity visibility and control: what IAM teams need to change?
Explore further
22/07/2026 4:39 pm
Identity resilience is no longer a recovery function, it is a posture discipline. The article’s core shift is away from waiting for crisis and toward controlling the conditions that make crisis more damaging. That is the right model for hybrid identity estates where a small configuration error can become a business outage. The practitioner takeaway is to treat identity posture as an always-on operating requirement, not a post-breach activity.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to Ultimate Guide to NHIs.
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing how slowly remediation still moves in practice.
A question worth separating out:
Q: Who should own identity rollback and change control when business systems depend on it?
A: Ownership should sit jointly with IAM, PAM, and operational security teams, because rollback decisions affect access governance and service continuity at the same time. If OT or disconnected environments are involved, the response model must also include local operational stakeholders and approved recovery paths.
👉 Read our full editorial: Identity visibility and control are now core to cyber resilience
