Topic starter
24/12/2025 9:44 am
TL;DR: Unmanaged endpoints widen the attack surface for remote work because credentials, tokens, cookies, and session data can be exposed outside IT control, while unmanaged or poorly managed devices are implicated in 80% of ransomware attacks and 71% more malware exposure, according to CyberArk and Microsoft Digital Defense Report 2023. The security issue is not remote access itself, but the lack of device trust, session control, and credential governance around it.
Editorial analysis by NHI Mgmt Group, based on content published by CyberArk: “Unmanaged Endpoints: Your Security Blind Spot”.
By the numbers:
- 80% of ransomware attacks originate from unmanaged devices, with 60% of those leveraging remote encryption, according to CyberArk.
- Users on unmanaged devices are 71% more likely to face malware, according to CyberArk.
- Nearly 70% of organizations have been victimized by cyberattacks exploiting unmanaged or poorly managed devices, according to CyberArk.
Key questions
Q: What breaks when teams manage SaaS, cloud, and endpoint access separately?
A: What breaks is the defender’s view of the intrusion.
Q: Why do unmanaged endpoints increase the risk of credential theft and session abuse?
A: They increase risk because the local device can store or expose reusable artefacts that belong to the identity session, not just the user.
A: Organisations should treat contractor access as a governed identity and application problem, not just an onboarding task.
Practitioner guidance
- Define unmanaged endpoints as a separate access-risk tier Inventory where employees, contractors and third parties access sensitive SaaS from personal or shared devices, then assign stronger controls to those flows than to managed endpoints.
- Move sensitive browser sessions into controlled pathways Use secure browser mediation for high-risk applications so cookies, passwords and other reusable artefacts do not persist on the local workstation.
- Extend monitoring beyond initial authentication Require continuous authentication, full audit trails and session recording for unmanaged-device sessions that reach critical business systems.
Bottom line: Unmanaged endpoints create an identity governance blind spot because access artefacts can be exposed on devices the organisation does not control.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 10 months ago by Abdelrahman
This topic was modified 4 days ago by NHI Mgmt Group
08/10/2026 5:42 pm
Unmanaged endpoints turn the device into part of the identity control plane: When access happens from personal or contractor-owned hardware, the organisation is no longer governing only the user or the NHI. It is also relying on a device it does not control to protect the artefacts that make access possible. That is why unmanaged endpoint risk is an identity governance problem, not just an endpoint hygiene problem. Practitioners should treat device trust as a prerequisite for access governance, not an afterthought.
A question worth separating out:
Q: Should organisations prioritise browser controls or password controls for unmanaged endpoints?
A: They need both, but browser controls usually reduce risk first because they prevent passwords and cookies from persisting on the unmanaged device. Password controls still matter, yet they do not solve the wider problem of session exposure once the browser is open and active.
👉 Read our full editorial: Unmanaged endpoints expose the blind spot in NHI governance