Topic starter
06/11/2026 6:37 pm
TL;DR: 75% of respondents increased identity security spending this year, 35% have fully implemented an identity-based APM solution, and 88% are already using or planning AI agents within 12 to 18 months, according to SpecterOps. The gap is no longer visibility; it is operational maturity, because attack-path findings still outpace prioritisation and remediation.
Editorial analysis by NHI Mgmt Group, based on content published by SpecterOps: “Identity APM Has Gone Mainstream. The Hard Work Is Just Starting.”.
Key questions
Q: How do teams prioritise identity attack path remediation?
A: Teams prioritise identity attack path remediation by ranking the paths that connect low-friction credentials to high-value assets, then fixing the weakest control first.
Q: Why do AI agents change infrastructure identity governance?
A: AI agents change the model because they can take actions, call tools, and operate without a human approving each step.
Q: What is the difference between explicit privilege and effective privilege?
A: Explicit privilege is access that is directly granted to a user, role, or account by policy or assignment.
Practitioner guidance
- Define a path-prioritisation rubric Rank remediation by how much attacker movement a fix collapses, how quickly it can be executed, and how many downstream paths it affects.
- Inventory AI agents as non-human identities Assign ownership, scope, and lifecycle responsibility to agentic workflows before they accumulate trust edges inside the identity graph.
- Build a remediation workflow with named owners Require system owners to accept, reject, or remediate top-ranked paths on a recurring cadence so findings do not stall in backlog review.
Bottom line: Identity attack path management is moving from a visibility exercise to a governance discipline that depends on ownership, prioritisation, and closure.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:41 pm
Identity attack path management is becoming a governance function, not just a discovery capability. SpecterOps's data shows adoption is rising, but the harder problem is turning graph findings into repeatable prioritisation and closure. When organisations can see paths but cannot reliably act on them, the programme has visibility without operational control. The field should treat APM as a cross-functional discipline anchored in ownership and remediation flow.
A question worth separating out:
Q: How do teams map identity attack paths to critical assets?
A: Teams map identity attack paths by tracing how accounts, groups, trusts, tokens, and delegated permissions can be chained to reach a critical asset such as a domain controller, cloud control plane, or sensitive database. The map usually starts from exposed identities and follows privilege escalation, lateral movement, inherited access, and secret reuse to show which path gives an attacker control.
👉 Read our full editorial: Identity APM is maturing faster than remediation practice