Topic starter
20/08/2026 11:37 am
TL;DR: Venice.io says the Stryker incident shows how stolen admin credentials and standing Microsoft Intune access let attackers wipe 200,000 devices, shut down 79 offices, and exfiltrate 50 terabytes without malware, zero-days, or lateral movement. Zero Standing Privilege is the control boundary that turns privileged access from a persistent liability into an ephemeral, task-scoped permission.
Editorial analysis by NHI Mgmt Group, based on content published by Venice.io: “200,000 Devices Wiped. No Malware Required.”.
Key questions
Q: What breaks when standing Intune admin access is not in place?
A: The main failure is not convenience, it is destructive control removal.
Q: Why is standing privileged access so dangerous for device-management platforms?
A: Because device-management platforms are designed to act at scale.
Q: What signs suggest a device-management admin role is being abused?
A: Look for sudden bulk actions, unusually rapid command sequences, administration from unfamiliar locations, or privileged activity that does not match normal maintenance patterns.
Practitioner guidance
- Eliminate standing Intune administrator roles Remove persistent Intune admin assignments and require task-scoped elevation so the role only exists during approved maintenance windows.
- Classify device-management admins as high-impact privilege Place Intune and similar management-plane roles under the same scrutiny as domain administration, with explicit approval and revocation rules.
- Tie elevation to continuous session evaluation Monitor active admin sessions for abnormal actions such as mass wipe commands, unusual source locations, or sudden changes in command volume.
Bottom line: Standing Intune access can turn a stolen admin credential into enterprise-wide destruction without malware or zero-days.
What's in the full article
Venice.io's full blog post covers the operational detail this post intentionally leaves for the source:
- The attack timeline from credential theft to Intune escalation and enterprise wipe commands
- The description of how the hidden script kept the wipe activity running
- The platform-specific explanation of Venice’s JIT role elevation mechanism
- The continuous access evaluation signals Venice says it uses during active admin sessions
👉 Read Venice.io’s analysis of standing Intune admin access and the Stryker wipe event →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
20/08/2026 11:37 am
Standing Intune admin access is a governance defect, not just an access-control choice. The role carries control-plane authority that can wipe devices, interrupt operations, and override business continuity assumptions. When that authority persists indefinitely, the organisation has effectively pre-authorised destructive action for any account that can inherit the role. Practitioners should treat persistent Intune administration as an unacceptable privilege exposure window.
A few things that frame the scale:
- 91% of organisations say at least half of their privileged access is always-on, and only 1% have fully implemented just-in-time privileged access, according to a CyberArk study.
A question worth separating out:
Q: Should organisations use JIT access or continuous monitoring for Intune admins?
A: They should use both for different purposes. JIT removes the standing entitlement so the role is not always available, while continuous monitoring helps detect abuse during the short window when access is active. One reduces exposure duration, the other constrains misuse inside that duration, which is why the controls are complementary rather than interchangeable.
👉 Read our full editorial: Standing Intune admin access turned Stryker into a wipe event