Topic starter
16/01/2026 5:46 pm
TL;DR: A red team exercise showed that a phishing click and a long-forgotten privileged account were enough to reach domain access while SOC and SIEM tooling stayed blind for weeks, according to Silverfort. The lesson is that identity risk cannot be managed by assumption, because visibility and credential misuse now determine whether perimeter controls actually hold.
Editorial analysis by NHI Mgmt Group, based on content published by Silverfort: “Don’t fear the Red Team: Why quantifying identity risk in the real world is the key to resilience”.
Key questions
Q: What breaks when identity visibility is too weak to quantify exposure?
A: What breaks first is governance, because teams cannot distinguish known risk from assumed safety.
Q: Why do privileged accounts create outsized breach risk?
A: Privileged accounts can change configurations, access sensitive data, and disable controls, so a single compromise often has disproportionate impact.
Q: How do teams know if identity security controls are actually working?
A: Identity security controls are working when teams can show a current view of high-risk entitlements, detect privilege drift quickly, and remove access before exposure spreads.
Practitioner guidance
- Quantify identity exposure with live inventory Create a current inventory of privileged, legacy, and high-risk accounts across all identity stores so exposure is measured rather than assumed.
- Test identity controls with red teaming Run red team scenarios that include phishing, dormant privilege, and lateral movement paths, not only perimeter and endpoint assumptions.
- Ring-fence non-human identities Restrict NHI use to the systems and contexts where each identity is intended to operate, and verify that scope remains enforceable.
Bottom line: The article shows that strong perimeter controls do not compensate for weak identity visibility when privileged account misuse is still possible.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
06/10/2026 11:39 pm
Identity visibility, not tooling volume, is the limiting factor in cyber defence. The article shows that organisations can accumulate mature SOC, SIEM, and perimeter controls and still be unable to answer the most basic question about exposure. That means the governance failure is not a lack of alerts, but a lack of trustworthy identity data. Practitioners should treat visibility as the prerequisite for every higher-order control decision.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should organisations decide which MFA approach to use for different access scenarios?
A: Start by matching the MFA pattern to the risk, user experience, and business criticality of the action being protected. Always on MFA suits broader account protection, while step-up authentication and time-sensitive re-authentication are better for higher-risk or sensitive moments. The right choice depends on whether you are protecting routine sign-in, privileged actions, or access to sensitive data.
👉 Read our full editorial: Identity visibility gaps are undermining cyber defence programmes