Notifications
Clear all
Topic starter
15/08/2026 6:06 pm
TL;DR: Authentication is only the checkpoint, not the control point, because most security stacks stop tracking identity activity once a session is established, according to ClearVector. The bigger issue is that machine identities, workload identities, and AI agents increasingly operate inside production with valid credentials that existing IAM, CNAPP, SIEM, and EDR tools were not designed to explain.
NHIMG editorial — based on content published by ClearVector: Security The question security tools were never built to answer
By the numbers:
- The average dwell time for a credential-based attack is 292 days, according to IBM's Cost of a Data Breach 2024 report.
Questions worth separating out
Q: How should security teams monitor identities after authentication in production?
A: Security teams should connect login events to runtime telemetry from cloud control planes, workload platforms, and identity-aware logs.
Q: Why do valid credentials still create so much risk in zero trust environments?
A: Because a credential can be valid and still be unsafe if it has more privilege than the current task requires.
Q: What do organisations get wrong about visibility in identity governance?
A: They often assume that seeing an identity relationship is the same as controlling it.
Practitioner guidance
- Define a runtime identity monitoring layer Track what authenticated identities do inside production after session establishment, including role assumption, resource access, and high-risk actions.
- Baseline expected behaviour by identity type Create separate behavioural baselines for human users, service accounts, workload identities, and AI agents so each class is judged against realistic runtime patterns rather than a generic login profile.
- Correlate session approval with production activity Join IdP session events to production control-plane and workload telemetry so a successful login does not become the end of the monitoring chain.
What's in the full article
ClearVector's full blog covers the operational detail this post intentionally leaves for the source:
- The production identity universe model used to distinguish human, service account, workload, and AI agent activity.
- The comparison of authentication, configuration, and runtime visibility layers across AWS, GCP, and Azure.
- The breach readiness reporting approach used to map exposures against live production identity behaviour.
- The dwell-time calculation behind the credential-based attack cost estimate.
👉 Read ClearVector's analysis of post-authentication identity blind spots in production →
Post-authentication identity behavior: what IAM teams are missing?
Explore further
15/08/2026 6:15 pm
Post-authentication identity blindness is the control gap IAM teams keep underestimating. Authentication tells you a session exists, not whether that session is behaving as expected inside production. Once that boundary is crossed, many organisations have no authoritative view of role assumptions, resource reach, or action sequence. The practitioner conclusion is simple: session acceptance is not identity governance.
A few things that frame the scale:
- 79% of organisations have experienced secrets leaks, with 77% of these incidents resulting in tangible damage, according to Ultimate Guide to NHIs.
- 91.6% of secrets remain valid five days after the targeted organisation is notified, which shows how slowly remediation can lag behind exposure.
A question worth separating out:
Q: Who should own post-authentication identity governance?
A: Ownership should sit across IAM, NHI, cloud security, and PAM teams because the problem crosses identity types and control layers. IAM approves access, but runtime governance needs cloud and workload telemetry, plus policy decisions about what each identity is allowed to do once active.
👉 Read our full editorial: Post-authentication identity blind spots are leaving production unwatched
