Topic starter
14/09/2026 10:09 am
TL;DR: The quarter's biggest breaches kept landing on the same control gaps across authentication, identity detection, recovery, third-party access, and edge exposure, according to Anomali. That pattern means defenders need controls that match attacker behavior, not periodic coverage checks.
Editorial analysis by NHI Mgmt Group, based on content published by Anomali: “Seven Controls That Would Have Stopped This Quarter's Biggest Breaches — And Why Most Orgs Still Lack Them”.
Key questions
Q: Why do identity-led attacks keep succeeding even when endpoint protection is in place?
A: Endpoint protection is designed to see malicious code, but many modern intrusions use stolen credentials, remote access tools, or built-in utilities that look legitimate at the endpoint layer.
Q: What breaks when backup recovery shares the same identity plane as production?
A: Recovery becomes vulnerable to the same credentials and admin paths the attacker used to reach production in the first place.
Q: What is the first control teams should fix when valid credentials keep beating perimeter security?
A: Start with phishing-resistant MFA for the access paths attackers most often target: privileged users, remote administrators, and externally exposed services.
Practitioner guidance
- Prioritise phishing-resistant MFA for privileged and remote access Replace replayable factors with hardware-backed or passkey-based authentication first for admins, support staff, and internet-facing remote access paths.
- Add identity telemetry to detection engineering Correlate authentications, token use, privilege changes, and remote administration activity so valid-account abuse is visible before lateral movement expands.
- Separate backup administration from production identities Remove shared directory dependencies, restrict backup-plane credentials, and test restore capability through a distinct recovery trust path.
Bottom line: The quarter's breach pattern was not random. It exposed repeatable control failures across authentication, identity detection, recovery, third-party access, and edge exposure.
Glossary terms: Phishing-Resistant MFA, Identity Threat Detection and Response, Immutable Backup, Third-Party Access Governance
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
14/09/2026 10:10 am
Control mismatch, not control absence, is the quarter's defining breach pattern: most organisations already have security tools, but those tools are not aligned to how modern intrusion chains begin and spread. Credential replay, identity abuse, supply-chain trust, and recovery denial all exploit assumptions baked into older defensive models. The practitioner conclusion is that governance must be judged by where controls fail operationally, not by whether they exist on paper.
A few things that frame the scale:
- Half of 1,100 global security leaders surveyed by CrowdStrike believed they were very well prepared for ransomware, yet 78% of their organisations had been attacked in the past year.
A question worth separating out:
Q: Should organisations prioritise edge-device monitoring or third-party access reviews first?
A: Both matter, but the first priority should be the paths that combine exposure with authority. Edge devices and supplier platforms deserve immediate focus when they can reach production systems, because they create the shortest route from compromise to impact. Review the paths that can actually change business state.
👉 Read our full editorial: Seven controls that would have changed this quarter's biggest breaches