Topic starter
19/12/2025 11:38 am
TL;DR: Attackers are increasingly using legitimate credentials, tokens, service accounts and SaaS integrations to move through environments instead of breaking in, according to Delinea Labs December 2025 Threat Outlook. The security problem is no longer authentication alone, but the trust assumptions embedded in identity, automation and federation controls.
Editorial analysis by NHI Mgmt Group, based on content published by Delinea: “Identity attacks are evolving faster than defenders can adapt”.
Key questions
Q: What fails when attackers can use legitimate identity pathways instead of breaking in?
A: What fails is the assumption that successful authentication means trusted access.
Q: Why do service accounts and tokens create more risk than many teams expect?
A: Because they often carry standing privilege, operate quietly, and remain valid long after the business need changes.
Q: What are the signs that identity-driven attacks are already underway?
A: Common signs include impossible travel, privilege misuse, dormant accounts suddenly becoming active, and suspicious credential use by identities that normally do little.
Practitioner guidance
- Harden trusted identity pathways Inventory tokens, service accounts, SCIM connectors and SaaS integrations as ingress paths, then scope them by the exact downstream systems they can reach.
- Reduce standing automation privilege Remove long-lived automation secrets where possible, rotate what remains, and constrain service accounts so a single compromised credential cannot reach multiple environments.
- Enforce adaptive authentication everywhere Require MFA and risk-based step-up for identity providers, privileged roles, admin workflows and federated access paths that currently rely on legacy exceptions.
Bottom line: Identity attacks are increasingly succeeding by abusing legitimate authentication, automation and federation paths rather than defeating them outright.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 10 months ago by Abdelrahman
This topic was modified 1 day ago by NHI Mgmt Group
11/10/2026 3:08 am
Authentication without authorization is now the dominant identity failure mode. The article shows attackers succeeding by using systems exactly as intended, which means successful login can no longer be treated as evidence of legitimate intent. That breaks the long-standing assumption that identity proof and access legitimacy move together. Practitioners should re-evaluate trust boundaries inside authentication flows, not just the strength of the login step.
A question worth separating out:
Q: How should teams respond when automation credentials are treated as trusted access?
A: They should treat automation credentials as high-value privilege, not as background infrastructure. That means limiting scope, removing standing access where possible, verifying federation and provisioning chains, and ensuring the same identity cannot move across environments without oversight. The goal is to shrink the blast radius before compromise becomes lateral movement.
👉 Read our full editorial: Identity attacks now exploit authentication and automation trust