It wasn’t ransomware headlines or zero-day exploits that stood out most on this 12 months’s Verizon 2025 Data Breach Investigations Report (DBIR) — it was what fueled them. Quietly, but persistently, two underlying elements performed a task in among the worst breaches: third-party publicity and machine credential abuse.
In accordance with the 2025 DBIR, third-party involvement in breaches doubled year-over-year, leaping from 15% to 30%. In parallel, attackers more and more exploited machine credentials and ungoverned machine accounts to realize entry, escalate privileges, and exfiltrate delicate information.
The message is evident: it is now not sufficient to guard your worker customers alone. To really defend towards fashionable threats, organizations should govern all identities — human, non-employee, and machine — inside a unified security technique.
Third-Get together Danger: Increasing Quicker Than Organizations Can Management
At this time’s enterprise is a patchwork of partnerships: contractors, distributors, enterprise companions, managed service suppliers, associates, and extra. Whereas these relationships drive effectivity, in addition they create sprawling id ecosystems. With out sturdy governance third-party identities change into blind spots ripe for exploitation.
Breaches tied to third-party entry usually stem from poor lifecycle administration — for instance, a contractor account left energetic after a mission ends, or a enterprise associate login with extreme privileges. The 2025 DBIR notes that this pattern is accelerating, and it is not confined to anyone trade: healthcare, finance, manufacturing, and the general public sector all reported main incidents stemming from third-party publicity.
Organizations should lengthen id governance to non-employees with the identical rigor utilized to inside employees, making certain visibility, accountability, and well timed deactivation throughout the total vary of third-party customers.
Machine Identities: The Hidden Gatekeepers to Important Techniques
Whereas human identities stay weak, machine identities are a fair faster-growing danger. Service accounts, bots, RPAs, AI brokers, APIs — the digital workforce — are exploding in quantity, usually with out clear possession or oversight. As AI brokers multiply, they’ll push machine id progress—and complexity—even past what organizations are managing in the present day.
This 12 months’s 2025 DBIR discovered that credential-based assaults stay a prime preliminary entry technique, and attackers are more and more concentrating on ungoverned machine accounts for entry. Unprotected machine accounts had been tied to main breaches and escalating ransomware assaults.
The stakes are rising; but most conventional id security instruments nonetheless deal with machines like second-class residents. That is why it is important to maneuver past advert hoc machine administration to a mannequin constructed for scale and automation. For a deeper dive into the issue, take a look at the whitepaper “Who’s Watching the Machines?”.
A Unified Method is No Longer Non-compulsory
Fragmented id governance is not a weak point anymore. It is a legal responsibility. Managing staff in a single silo, third-party customers in one other, and machines — if in any respect — in a 3rd leaves cracks extensive sufficient for attackers to stroll via. They needn’t breach every thing. They simply want one opening.
Breaches tied to third-party customers and machine accounts are accelerating sooner than these tied to inside staff — a transparent warning signal that inconsistent governance is fueling new vulnerabilities. The truth is: id is id. Human, non-employee, or machine, each id should be correctly managed, ruled, and secured beneath a unified technique.
The organizations that survive tomorrow’s threats aren’t those who attempt to harmonize options — they’re those who acknowledge that governing each id collectively is the one approach ahead. Consolidating id security throughout staff, contractors, companions, service accounts, bots, and AI brokers closes essential gaps, boosts visibility, and hardens defenses when it issues most.
SailPoint helps organizations safe the total spectrum of identities with options designed for in the present day’s advanced enterprise environments — at enterprise scale. Whether or not you are managing machine identities or securing non-employee entry, SailPoint delivers a unified id security expertise—powered by the SailPoint Atlas platform—that turns id chaos into readability.
To dig deeper into why machine identities, require a brand new strategy — and why conventional human-centric fashions are now not sufficient — discover our three-part article collection protecting what a machine id is (and why the definition issues), how machine identities advanced alongside human identities, and why conventional governance strategies are failing in a machine-driven world.
The hole between human and machine id security is widening. It is time to shut it — earlier than attackers do it for you.
Supply:
Verizon 2025 Data Breach Investigations Report (DBIR)
