Topic starter
14/09/2026 10:09 am
TL;DR: July 2026’s breach wave exposed the same seven failure points, including phishing-resistant MFA, ITDR, immutable backups, third-party access governance, and continuous edge scanning, as 799 ransomware attacks and a 29-minute breakout time compressed defender response windows, according to Anomali. The governing problem is not lack of tools but control mismatch: attackers are using valid credentials, supply-chain trust, and recovery denial faster than periodic defensive models can adapt.
Editorial analysis by NHI Mgmt Group, based on content published by Anomali: “Seven Controls That Would Have Stopped This Quarter's Biggest Breaches — And Why Most Orgs Still Lack Them”.
Key questions
Q: What is the first control teams should fix when valid credentials keep beating perimeter security?
A: Start with phishing-resistant MFA for the access paths attackers most often target: privileged users, remote administrators, and externally exposed services.
Q: Why do identity-led attacks keep succeeding even when endpoint protection is in place?
A: Endpoint protection is designed to see malicious code, but many modern intrusions use stolen credentials, remote access tools, or built-in utilities that look legitimate at the endpoint layer.
Q: What breaks when backup recovery shares the same identity plane as production?
A: Recovery becomes vulnerable to the same credentials and admin paths the attacker used to reach production in the first place.
Practitioner guidance
- Prioritise phishing-resistant MFA for privileged and remote access Replace replayable factors with hardware-backed or passkey-based authentication first for admins, support staff, and internet-facing remote access paths.
- Add identity telemetry to detection engineering Correlate authentications, token use, privilege changes, and remote administration activity so valid-account abuse is visible before lateral movement expands.
- Separate backup administration from production identities Remove shared directory dependencies, restrict backup-plane credentials, and test restore capability through a distinct recovery trust path.
Bottom line: The quarter's breach pattern was not random. It exposed repeatable control failures across authentication, identity detection, recovery, third-party access, and edge exposure.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/09/2026 10:10 am
Control mismatch, not control absence, is the quarter's defining breach pattern: most organisations already have security tools, but those tools are not aligned to how modern intrusion chains begin and spread. Credential replay, identity abuse, supply-chain trust, and recovery denial all exploit assumptions baked into older defensive models. The practitioner conclusion is that governance must be judged by where controls fail operationally, not by whether they exist on paper.
A few things that frame the scale:
- Half of 1,100 global security leaders surveyed by CrowdStrike believed they were very well prepared for ransomware, yet 78% of their organisations had been attacked in the past year.
A question worth separating out:
Q: Should organisations prioritise edge-device monitoring or third-party access reviews first?
A: Both matter, but the first priority should be the paths that combine exposure with authority. Edge devices and supplier platforms deserve immediate focus when they can reach production systems, because they create the shortest route from compromise to impact. Review the paths that can actually change business state.
👉 Read our full editorial: Seven controls that would have changed this quarter's biggest breaches