Topic starter
25/08/2026 6:10 pm
TL;DR: IBM’s 2026 Cost of a Data Breach Report puts the global average breach at $4.99 million and shows phishing, social engineering, and valid-account abuse still dominate initial access, according to Enzoic’s analysis. The real issue is that successful authentication can no longer be treated as proof of trust, because compromised credentials can behave like legitimate users for months.
Editorial analysis by NHI Mgmt Group, based on content published by Enzoic: “The Rising Cost of Trusted Access”.
By the numbers:
- The global average cost of a data breach reached a record $4.99 million in IBM’s 2026 report.
- In the United States, the average breach cost rose to $11.5 million.
- Detection and escalation costs combined with lost business accounted for 63% of the average breach cost.
Key questions
Q: What breaks when an attacker gets a valid user account instead of malware?
A: A valid account bypasses many perimeter defenses and often looks legitimate in logs, which makes early detection harder.
Q: Why do phishing and social engineering make identity risk more expensive?
A: They are effective because they target the trust layer directly, stealing working credentials or persuading users to approve access.
Q: How do IAM teams know whether token controls are actually working?
A: IAM teams should look for short revocation latency, low scope overlap, clear ownership, and successful invalidation across downstream applications.
Practitioner guidance
- Treat successful authentication as insufficient evidence of trust Separate authentication success from trust decisions in your incident, IAM, and access-review processes.
- Add continuous credential exposure checks Screen passwords, tokens, and other reusable credentials against exposure data throughout their lifecycle so previously clean secrets can be reassessed when risk changes.
- Prioritise valid-account abuse in detection engineering Build alerting for unusual behaviour on legitimate accounts, including impossible travel, atypical resource access, and abnormal access timing, because attacker activity may begin after successful authentication.
Bottom line: Valid-account abuse turns legitimate authentication into a security blind spot that can persist for months before containment.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/08/2026 6:11 pm
Trusted access is now a cost multiplier because breach economics follow identity trust, not just perimeter failure. Once an attacker is inside a valid account, the organisation loses the early warning advantage that comes from obvious malicious activity. That shifts the financial burden toward longer dwell time, escalation costs, and lost business. The practitioner lesson is that identity assurance must be managed as an ongoing state, not a one-time control outcome.
A question worth separating out:
Q: How should security teams respond when a trusted identity is suspected of being compromised?
A: Security teams should treat the alert as a containment event, not a routine ticket. The first move is to validate the signal, then revoke access quickly enough to stop lateral movement. In higher-risk cases, disable all accounts tied to the identity, isolate affected systems, and move to controlled recovery. The key is speed, policy-based automation, and clear escalation paths before an attacker expands reach.
👉 Read our full editorial: Trusted access is the new breach cost multiplier in identity security