Topic starter
02/01/2026 10:54 am
TL;DR: Identity-based attacks now span phishing, credential stuffing, Kerberoasting, Golden Ticket abuse, and other account takeover paths, while nearly half of organisations lack the staffing or funding to modernize IAM, according to Gartner and Twine Security. The governance gap is no longer about awareness. It is about whether identity controls can keep pace with attacker reuse of valid credentials and privilege paths.
Editorial analysis by NHI Mgmt Group, based on content published by Twine Security: “7 Critical Identity-Related Attack Types”.
By the numbers:
- Almost 50% of organisations are not adequately staffed or funded for new IAM projects or IAM modernization efforts, mostly due to the lack of skilled IAM personnel, according to Gartner research cited by Twine Security.
Key questions
Q: What breaks when IAM teams cannot keep up with identity-related attack types?
A: IAM breaks at the points where legitimate access can still be reused, forged, or escalated.
Q: Why do Kerberoasting and ticket-forgery attacks remain effective in Active Directory?
A: They work because service-account trust is durable and often over-privileged.
Q: How should security teams prioritise IAM modernization when resources are limited?
A: Start with the controls that reduce the highest-volume abuse paths first: MFA, service-account privilege reduction, and deprovisioning discipline.
Practitioner guidance
- Strengthen authentication around reused credentials Require MFA on all externally reachable identity paths, especially VPN, remote access, and admin workflows that credential-stuffing tools target.
- Reduce service-account privilege surface Review service accounts that can request Kerberos tickets or reach high-value data stores, then remove permissions that are not essential to the service.
- Audit Active Directory ticket trust assumptions Identify where forged-ticket abuse would still succeed if a service-account hash or KRBTGT secret were exposed, and flag those paths for urgent redesign.
Bottom line: Identity-related attacks are exploiting the gap between IAM policy and IAM operating capacity, especially where credentials and ticket trust can still be reused.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
06/10/2026 9:18 pm
Identity attack patterns are now testing IAM as an operational control, not just an access policy. Phishing, credential stuffing, and ticket abuse all exploit the gap between what IAM intends and what the enterprise can execute repeatedly. The problem is no longer whether teams understand the threats. The issue is whether the control set can still distinguish legitimate access from attacker reuse at volume. Practitioners should treat IAM modernization as an execution discipline, not a roadmap item.
A question worth separating out:
Q: How do organisations know whether IAM is actually keeping pace with attack patterns?
A: Look for the absence of residual access states such as orphaned accounts, excessive privilege, and stale credentials after lifecycle changes. If those states persist, the programme may have policies on paper but not enough operational capacity to enforce them.
👉 Read our full editorial: Identity-related attack patterns are exposing IAM modernization gaps