Topic starter
25/06/2026 12:09 am
TL;DR: Attackers are increasingly weaponizing trust links such as OAuth tokens, service accounts, and consent flows to persist across SaaS and cloud environments, while Delinea Labs notes 524 identity-related CVEs in October, including 43 in identity products. The real failure is that identity programmes still assume trust boundaries remain stable long enough for review, rotation, and detection to catch up.
Editorial analysis by NHI Mgmt Group, based on content published by Delinea: “Trust eroding: Delinea Labs November 2025 Threat Outlook”.
Key questions
Q: What breaks when cloud identities are not centrally governed?
A: Shadow accounts, orphaned credentials and inconsistent role definitions emerge because no single process can see the whole access picture.
Q: Why are OAuth tokens such a persistent SaaS security risk?
A: OAuth tokens are persistent because they often bypass MFA, carry broad delegated permissions, and remain valid long after the original approval.
Q: What signs show that machine identities are outside governance?
A: Warning signs include service accounts with no clear owner, static API credentials that never expire, tokens reused across multiple systems, and integrations that are never reviewed after deployment.
Practitioner guidance
- Map delegated trust paths Inventory OAuth grants, service accounts, connectors and static credentials together so you can see which identities inherit authority from which approvals or integrations.
- Review consented applications Reassess app consents that can access mail, files or cloud resources without a fresh user challenge, especially where those grants span tenants or business units.
- Assign owners to machine identities Require a named business and technical owner for every service account and API credential, including an expiry date and a documented revocation path.
Bottom line: Cloud attackers are increasingly using delegated trust paths such as OAuth tokens, consent flows and service accounts to persist without obvious login activity.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 9:00 am
Trust erosion is now the governing failure mode in cloud identity. The central risk is no longer a password being guessed or phished. It is that delegated access, consented applications and machine identities accumulate authority that outlives the operational context that justified them. That shifts governance from login control to trust-chain control, and organisations that still treat those as separate problems are managing the wrong boundary.
A question worth separating out:
Q: How should security teams respond when a stolen cloud credential is used to create new identities?
A: Teams should treat new identity creation after credential compromise as active persistence, not routine administration. The immediate response is to revoke the exposed credential, disable the abused identities, review recent policy changes, and inspect for reconnaissance or compute abuse. It is also essential to search for similar naming patterns, since attackers often create backup or service accounts to blend in.
👉 Read our full editorial: Trust erosion is the new identity risk in cloud environments