Topic starter
24/06/2026 11:18 pm
TL;DR: 54% of executives now rank AI-enhanced threats as their top 2026 concern, while 43% of practitioners still face credential stuffing and password spraying most often, according to Silverfort’s coverage of The Identity Underground Annual Pulse 2026, showing a widening gap between strategic fear and operational reality. The underlying problem is not awareness but control reach: programmes built for review cycles and legacy estates cannot govern identities moving faster than they are seen.
Editorial analysis by NHI Mgmt Group, based on content published by Silverfort: “‘The Identity Underground’ community shares research on the Identity Security consolidation wave”.
By the numbers:
- 54% of executives cite AI-enhanced threats as their top concern for 2026.
- 43% of practitioners say credential stuffing and password spraying are still their most frequent attacks.
- 82% say legacy infrastructure actively creates identity security risk.
Key questions
Q: What breaks when organisations cannot see all of their non-human identities?
A: What breaks is governance itself.
Q: Why do legacy authentication settings create ongoing identity risk?
A: Legacy settings preserve compatibility but also preserve weak assurance.
Q: What are the signs that manual identity response is no longer working?
A: The clearest sign is when detection confidence exists but containment still depends on analysts stitching together logs from multiple systems by hand.
Practitioner guidance
- Map the full non-human identity estate Inventory service accounts, API keys, workload identities, and third-party access paths with named ownership and business purpose attached to each item.
- Reduce legacy authentication exposure Identify where NTLM and other inherited authentication paths still support business operations, then prioritise those dependencies for containment and retirement planning.
- Replace manual identity triage with measurable response paths Define the handoff from IdP, PAM, IGA, and SIEM signals to containment actions so response time is governed, not improvised.
Bottom line: Identity security is being pulled between future-facing AI concerns and present-day credential abuse, and that split is widening rather than resolving itself.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 8:06 am
Identity security now has an inventory problem before it has a response problem. The article shows that organisations are trying to govern estates they cannot fully enumerate, especially across non-human identities. When 5% of organisations believe they have a complete NHI inventory, lifecycle governance is already operating on partial truth. The practitioner conclusion is blunt: you cannot assign accountability, risk, or review to identities you have not mapped.
A question worth separating out:
Q: How should organisations govern third-party identity access more tightly?
A: Treat third-party access as a lifecycle problem, not a procurement checkbox. Require business ownership, least-privilege entitlements, expiry dates, periodic review, and immediate revocation when the relationship ends. Apply the same standards to partner accounts, support users, and vendor automation tokens that you would expect for internal privileged access.
👉 Read our full editorial: Identity security’s two axes of tension are widening in 2026