Topic starter
16/01/2026 5:34 pm
TL;DR: Identity security now needs runtime visibility, inline prevention and response across human and non-human access, according to Silverfort, because 75% of detections are malware-free and identity abuse increasingly moves across cloud and on-prem domains. Access governance alone is no longer enough when attackers log in rather than break in.
Editorial analysis by NHI Mgmt Group, based on content published by Silverfort: “6 capabilities every identity security platform must have”.
By the numbers:
- 75% of detections are malware-free, according to research from the Securing the Identity Attack Surface report cited by Silverfort.
Key questions
Q: How should security teams stop identity abuse before a session is established?
A: Security teams should enforce controls at authentication time, not only in downstream reviews.
Q: Why do malware-free attacks change identity security priorities?
A: Because they remove the signal that many tools rely on, which means detections must focus on identity behaviour instead of malicious code.
Q: What breaks when non-human identities have more access than they need?
A: When non-human identities carry excess access, a single compromise can move from a local incident to broad cloud control.
Practitioner guidance
- Expand identity visibility across human and non-human accounts Build a single inventory that includes service accounts, API keys, certificates, cloud roles and privileged users so ownership and usage can be traced across environments.
- Move enforcement to the authentication layer Use inline controls that inspect login attempts before a session is established, so suspicious access can be challenged or blocked in real time.
- Harden privileged account pathways Prioritise accounts that can reach critical systems directly, including admin logins that bypass central workflows, and constrain where those accounts can be used.
Bottom line: Identity security now has to cover runtime visibility and response, because attackers increasingly use legitimate credentials rather than malware.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
06/10/2026 11:50 pm
Identity security has outgrown the governance-only model. IAM, IGA and PAM still matter, but they stop short of the point where identity abuse actually occurs: at authentication and session initiation. Once attackers use legitimate credentials, the security problem becomes runtime control, not just access administration. Practitioners should treat identity security as a control layer that begins where governance ends.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should identity security teams prioritise PAM or runtime response first?
A: They should not treat them as substitutes. PAM helps govern privileged access, but runtime response is what can interrupt malicious use during an active attack, especially when identity abuse moves through legitimate login flows and legacy protocols.
👉 Read our full editorial: Identity security now spans visibility, prevention and response