Topic starter
22/02/2026 9:53 pm
TL;DR: Ransomware containment speed determines whether an incident becomes a brief disruption or a prolonged shutdown, and Change Healthcare, Colonial Pipeline, and Marks & Spencer all show how identity uncertainty forces broad containment, according to Omada Identity. When responders cannot answer what an identity can reach, access review cadences, entitlement visibility, and revocation workflows fail as live controls.
Editorial analysis by NHI Mgmt Group, based on content published by Omada Identity: “During a Ransomware Attack: How IGA Enables Rapid Containment”.
Key questions
Q: What breaks when responders cannot see what a compromised identity can reach?
A: Containment breaks first.
Q: Why do ransomware incidents often force broad shutdowns instead of surgical containment?
A: Because responders cannot always prove which identities, systems, and trust paths are already affected.
A: Teams often overfocus on the payload and underinvest in the identity layer.
Practitioner guidance
- Map identity blast radius before an incident Aggregate current entitlements across directories, SaaS, cloud platforms, databases, and vendor-linked accounts so responders can see what a compromised identity can actually reach.
- Pre-stage governed revocation workflows Configure suspension and entitlement removal actions so they propagate to connected systems automatically instead of requiring manual changes in multiple consoles.
- Prioritise high-risk identities for containment Build a triage view that weighs privilege level, MFA exposure, recent changes, and business criticality, then use it to choose containment order during the first hour.
Bottom line: Ransomware containment depends on knowing the current reach of compromised identities, not just detecting that an account has been abused.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/10/2026 2:48 am
Identity visibility is the difference between surgical containment and enterprise shutdown. Ransomware becomes operationally catastrophic when responders cannot answer what a compromised identity can reach in real time. That is not primarily a detection failure, it is an identity governance failure because the organisation lacks a current, authoritative view of entitlements. The practitioner conclusion is blunt: if access cannot be mapped quickly, containment defaults to disruption.
A few things that frame the scale:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
A question worth separating out:
Q: How should organisations decide which identities to contain first?
A: Start with identities that combine high privilege, weak exposure signals, and business-critical access. That includes administrators, directory sync accounts, backup access, and identities with recent suspicious changes. The goal is to suppress the accounts most likely to expand the incident before you spend time on lower-impact accounts.
👉 Read our full editorial: Ransomware containment depends on identity visibility and rapid IGA action