What should organisations do when controls are not catching every attack?

Why This Matters for Security Teams

When controls miss attacks, the failure is usually not that every safeguard is broken. The real problem is that some access paths remain too permissive, too long-lived, or too hard to observe. For NHI-heavy environments, that means service accounts, API keys, certificates, and delegated tokens can be reused long after the original trust decision made sense. NHI Management Group’s Ultimate Guide to NHIs — Key Challenges and Risks shows that 97% of NHIs carry excessive privileges, which helps explain why control-by-control audits often look better than real attack resistance.

Security teams should treat missed detections as a design signal, not just a monitoring gap. If attackers can pivot through standing credentials, lateral movement becomes an identity problem as much as a network problem. That is why resilience thinking matters: it forces organisations to ask which exposures are still acceptable, which ones need tighter governance, and which ones require architectural change. This aligns with the operational lessons in the 52 NHI Breaches Analysis and with threat guidance from CISA cyber threat advisories.

In practice, many security teams encounter control failure only after an attacker has already chained weak trust decisions together.

How It Works in Practice

Control resilience starts with mapping where identity trust is delegated and where a failed control would still leave the attacker room to move. That usually means separating prevention, detection, and containment for NHI usage instead of assuming one control can do all three. Organisations should inventory standing privileges, identify which secrets are long-lived, and determine whether each workload can be issued short-lived credentials at runtime.

For identity governance, the practical model is to reduce the blast radius of any single failure. Use least privilege, but do not stop there. Pair it with rotation, revocation, and workload scoping so that a compromised token expires quickly and cannot be reused across systems. NHI Mgmt Group’s Ultimate Guide to NHIs — Why NHI Security Matters Now reinforces the point that NHIs now outnumber human identities by 25x to 50x, which means manual review cannot scale as the main line of defence.

• Identify every standing secret, service account, and API key that can reach sensitive systems.
• Replace long-lived credentials with short-lived tokens where the workload supports it.
• Bind access to context, such as workload identity, environment, and request purpose.
• Define compensating controls for high-risk paths, including tighter monitoring and explicit approval.
• Test whether revocation actually stops access, not just whether a ticket says it should.

This is where current guidance suggests a shift from “control present” to “control effective under attack.” A breach-resistant programme can explain what happens when a secret is stolen, how quickly it is revoked, and which downstream systems still remain reachable. These controls tend to break down in CI/CD-heavy environments with distributed secrets sprawl because ownership is fragmented and revocation often lags behind deployment speed.

Common Variations and Edge Cases

Tighter control often increases operational overhead, so organisations have to balance resilience against delivery speed and service reliability. In mature environments, the question is not whether to add more controls, but where extra friction materially reduces attacker options without breaking essential workflows.

There is no universal standard for this yet, especially for autonomous systems and agentic workloads. Best practice is evolving toward runtime policy evaluation and short-lived, workload-bound identity, but legacy platforms often still depend on static credentials and broad service permissions. In those cases, compensating controls such as network segmentation, secret-scanning, and stronger incident response can help, but they do not remove the underlying exposure.

One useful threshold is whether the organisation can prove that compromise of one identity does not automatically expose a second system. If it cannot, the programme is still relying on trust inheritance rather than resilience. The threat pattern described in Schneider Electric credentials breach and broader attacker behaviour documented in MITRE ATLAS adversarial AI threat matrix both show how quickly stolen identity material can be operationalised once controls fail.

Related resources from NHI Mgmt Group

• When should organisations escalate email risk into identity and fraud controls?
• What is the difference between attack surface management and NHI governance?
• How do organisations operationalise NHI ownership at scale?
• What is the difference between human IAM controls and NHI governance?