Topic starter
12/06/2026 10:01 pm
TL;DR: Credential theft now drives a large share of breaches, with 22% starting from stolen or compromised credentials and 88% of web app breaches using stolen credentials, according to JumpCloud. Identity-first controls matter because the old perimeter defends the wrong boundary for modern access patterns.
Editorial analysis by NHI Mgmt Group, based on content published by JumpCloud: “Zero Trust Economics. From Perimeter Defense to Identity-First Margins.”.
By the numbers:
- 22% of breaches started with stolen or compromised credentials.
- 60% of breaches involved human factors, credential misuse, errors, or social engineering.
- 88% of web app breaches used stolen credentials.
Key questions
Q: How should MSPs reduce password risk across both their own staff and client environments?
A: MSPs should centralise password governance, enforce strong policy controls, and limit standing access across tenants.
Q: Why do perimeter tools deliver less value against identity-led breaches?
A: Because perimeter tools judge traffic at the boundary, while identity-led breaches use legitimate authentication and then behave like normal users.
Q: What breaks when VPN-based remote access is the default for OT?
A: VPN-based access often grants broader network reach than the task requires, which expands the attack surface and makes lateral movement easier.
Practitioner guidance
- Re-map security spend to access risk Identify where firewall, VPN, and segmentation spend is protecting low-value network boundaries while credential-led access remains broad.
- Limit network reach with ZTNA Pilot per-application access for remote users and new cloud apps so that authentication grants only the minimum session needed.
- Tighten privileged access boundaries Review which admin and service credentials can reach multiple systems after login, then collapse those scopes to task-specific access paths.
Bottom line: The core risk is not that perimeter controls stopped working, but that they now protect a boundary that attackers bypass with valid credentials.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
13/06/2026 12:31 am
Identity, not the perimeter, is now the control plane that determines breach cost. The article is right to frame perimeter defence as an economic mismatch, because stolen credentials now open the door more often than direct network exploitation. When access itself is the attack path, spending more on edge infrastructure buys diminishing returns. Practitioners should judge control effectiveness by how tightly identity sessions are scoped, not by how much network hardware surrounds them.
A few things that frame the scale:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should organisations prioritise ZTNA or deeper identity governance first?
A: They should do both, but identity governance should define the access scope and ZTNA should enforce it. ZTNA without entitlement discipline simply moves broad access into a different tunnel, while governance without enforcement leaves the same exposure in place.
👉 Read our full editorial: Identity-first security economics are overtaking perimeter models for MSPs
This post was modified 6 days ago by NHI Mgmt Group