Technical analysis of the shift from malware-centric to identity-based attacks discussed at RSAC 2026, focusing on NHI security and public breach numbing.
From Malware Payloads to Stolen Credentials
Discussions at RSAC 2026 put a familiar shift into sharper focus: many successful breaches no longer depend on novel malware. Attackers steal or buy valid credentials, abuse OAuth grants, or hijack session tokens, then move with the same privileges a legitimate user or service already has. Network perimeters and signature-based endpoint tools still matter, but they see less of the real action when the path in looks like normal authentication.
That change forces a different defensive posture. Instead of asking only “what binary ran,” teams need continuous answers to “who is this principal, what should it access, and does this request fit its history.” Identity becomes the control plane—not a bolt-on after the firewall.
Non-Human Identities as the Soft Middle
Non-human identities (NHIs)—service accounts, API keys, workload certificates, CI/CD tokens, and machine-to-machine roles—often outnumber people and live longer with weaker review. They are created for automation, then left with broad scopes because rotating or scoping them breaks pipelines. Attackers know this: a single long-lived secret can unlock data stores, cloud APIs, and internal tools without ever touching a phishing page aimed at a human.
Practical NHI security starts with inventory and ownership. Every secret and machine identity needs a named owner, a purpose, an expiry or rotation path, and the minimum scopes required for that purpose. Prefer short-lived credentials issued by a workload identity system over static keys in environment variables or config files. Treat CI runners and build agents as high-value principals: they often hold deploy rights that human accounts never should.
- Map every NHI to a workload, environment, and owner; delete or disable orphans on a fixed cadence.
- Issue short-lived tokens where possible; rotate static secrets on a schedule you can prove in logs.
- Scope roles to single jobs or services; avoid shared “automation” accounts across products.
- Alert on first use from new networks, unusual APIs, or privilege changes—not only on failed logins.
When Breach Headlines Stop Changing Behavior
Public breach reporting has a numbing effect. After enough high-profile incidents, “credentials compromised” stops sounding urgent. That fatigue shows up operationally: ticket queues grow, rotation projects slip, and exception lists for over-privileged service accounts become permanent. Identity-based attacks thrive in that gap between awareness and follow-through.
Counter the numb response with concrete internal metrics rather than external drama. Track how many NHIs lack owners, how many secrets are older than policy allows, and how often privileged sessions occur without step-up verification. Review those numbers in the same forums that already own reliability—so identity hygiene is treated like uptime, not optional security theater.
What Perimeter Death Means in Practice
“Death of the perimeter” does not mean networks vanish. It means trust can no longer be inferred from being inside a VPN or VPC. Zero-trust style controls—strong authentication for humans, mutual TLS or signed workload identity for machines, least privilege by default, and continuous session evaluation—replace the assumption that location equals safety.
Teams that leave RSAC 2026 with only a longer tool list will fall behind. The durable work is process: inventory NHIs, shrink standing privileges, instrument auth and token use as first-class telemetry, and refuse to normalize “we already know credentials get stolen.” Identity-centric defense is slower to demo than a new scanner, but it is where the attack path actually moved.