Notifications
Clear all
Topic starter
19/08/2026 3:44 pm
TL;DR: Attackers are increasingly bypassing MFA by stealing session cookies, then operating inside authenticated sessions where most identity programs lose visibility, according to Expel's analysis of a video interview with Jason Rebholz. The real gap is not login security alone but post-authentication detection, least-privilege drift, and the growing governance burden of non-human identities and AI agents.
NHIMG editorial — based on content published by Expel: LLMjacking: How Attackers Hijack AI Using Compromised NHIs
By the numbers:
- Only 5.7% of organisations have full visibility into their service accounts.
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys.
- NHIs outnumber human identities by 25x to 50x in modern enterprises.
Questions worth separating out
Q: What breaks when security teams rely only on MFA and login controls?
A: The control set stops at authentication, but attackers do not.
Q: Why do session hijacking attacks remain effective in SaaS environments?
A: SaaS environments fragment activity across many tools, so a valid session can move through applications without a single unified security checkpoint.
Q: What do organisations get wrong about least privilege in access control?
A: Many teams treat least privilege as a provisioning rule instead of a living authorization outcome.
Practitioner guidance
- Instrument session-level detection across SaaS apps Collect application logs before the incident, then correlate file access, exports, privilege changes, and unusual application hopping into one identity timeline.
- Treat cookie replay as an identity threat model Add detections for impossible session reuse, token replay, and anomalous browser or device patterns that indicate a stolen session rather than a failed login.
- Map and govern non-human identities as first-class assets Inventory service accounts, API keys, tokens, and AI agent identities together, then assign owners, scope, and offboarding triggers so they are visible in the same control plane as human access.
What's in the full article
Expel's full blog covers the interview detail this post intentionally leaves for the source:
- The interview transcript and direct commentary from Jason Rebholz on why attackers prefer session theft over brute-force login attacks.
- The concrete examples he gives for post-authentication blind spots across SaaS applications and investigation workflows.
- The discussion of non-human identities and why agent-to-agent trust chains are becoming an identity governance problem.
- The original video interview that provides the full context behind the article's claims.
👉 Read Expel's analysis of session hijacking and post-authentication identity risk →
Session hijacking and NHI sprawl: are your controls keeping up?
Explore further
19/08/2026 4:22 pm
Post-authentication blindness is the governing failure, not weak login security. The industry has over-invested in the front door and under-invested in what happens after authentication succeeds. That creates a false sense of closure around identity risk, because the attacker now lives inside a valid session. The implication is that identity programmes must be judged on continuous visibility, not login hardening alone.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to Ultimate Guide to NHIs.
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing how remediation lag keeps exposure alive after discovery.
A question worth separating out:
Q: Who should be accountable for AI identity governance?
A: Accountability should sit with the team that owns the workflow and the team that owns identity controls, because AI access crosses both domains. Security, platform, and application owners each hold part of the lifecycle, but one business owner must remain responsible for the access decision and its removal.
👉 Read our full editorial: Post-authentication identity risk is where attackers win today
