Why do IdPs and EDR tools miss some identity compromises?

Why This Matters for Security Teams

Identity compromise is often treated as a login problem, but the operational signal usually appears later, when an attacker uses access to alter payroll, recovery settings, forwarding rules, or API-driven workflows. That is why IdPs and EDR tools can look healthy while the compromise is already active. The blind spot is not just technical telemetry, it is the business activity that follows the authentication event. NHIMG’s 52 NHI Breaches Analysis shows how often identity abuse becomes visible only after downstream misuse has begun.

This gap is widening as attackers blend human and non-human identities, chain tokens, and operate through SaaS and collaboration systems that sit outside traditional endpoint coverage. The same pattern appears in autonomous workflows: once a credential or session is valid, the next move may be an email change, approval abuse, or tool invocation rather than a noisy endpoint action. In practice, many security teams encounter the compromise only after finance, HR, or support tickets reveal unexplained account changes.

How It Works in Practice

IdPs are designed to answer whether an identity authenticated, and EDR is designed to answer whether a device behaved suspiciously. Neither is built to fully observe what happens after the session is granted. If an attacker uses stolen credentials to update recovery email addresses, add forwarding, change MFA settings, or trigger SaaS actions, the IdP may still report a valid sign-in and the endpoint may remain quiet. That is why identity investigations increasingly require email, SaaS audit, and workflow logs alongside authentication telemetry.

Current guidance suggests correlating three layers of evidence: authentication, post-authentication actions, and downstream business effects. This is especially important where email is the confirmation channel, because password reset links, recovery prompts, and approval notifications often become the hidden evidence trail. NHIMG’s Ultimate Guide to NHIs notes that 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, which reinforces how often valid identity material is the real control failure.

• Monitor inbox rules, recovery settings, and forwarding changes as first-class security events.
• Review SaaS admin, HR, payroll, and ticketing logs for changes that follow authentication by minutes or hours.
• Use conditional access and step-up checks, but do not assume they catch post-login abuse.
• Preserve email telemetry because it often contains the only evidence of notification-based confirmation flows.

These controls tend to break down in cloud-heavy environments where business actions are spread across multiple SaaS platforms and no single log source captures the full chain.

Common Variations and Edge Cases

Tighter identity monitoring often increases investigation overhead, requiring organisations to balance visibility against alert volume and log retention cost. The biggest operational tradeoff is that broader detection means more correlation work across systems that were never designed to agree on user, session, or object identity.

There is no universal standard for this yet, but best practice is evolving toward notification-aware detection, especially where recovery workflows, approval chains, and delegated administration create quiet compromise paths. The problem is even harder in agentic and automated environments, where compromised credentials may drive actions through inboxes, tickets, or APIs without a visible endpoint trace. Anthropic’s report on the first AI-orchestrated cyber espionage campaign underscores how rapidly attackers can adapt automation to evade traditional monitoring. For organisations mapping identity risk more broadly, NHIMG’s Ultimate Guide to NHIs — Why NHI Security Matters Now remains a useful baseline for understanding why valid access is not the same as safe access.

Edge cases include shared mailboxes, delegated admin roles, legacy MFA recovery flows, and service accounts that trigger business notifications indirectly. In those environments, a valid session can still be malicious even when every control says the identity is authenticated.

Related resources from NHI Mgmt Group

• Why do single-surface tools miss multi-stage identity attacks?
• Why do traditional email security tools miss payload-less BEC attacks?
• Why does identity matter more when vulnerabilities are discovered faster than they can be patched?
• What is the difference between prompt injection risk and identity abuse in agents?