Identity and Access Management Security: The Control Plane Attackers Target

Syncing Domain Admins into Entra ID lets attackers pivot from compromised on-prem AD to the cloud, and back via password writeback. CIS and Microsoft advise keeping privileged admin accounts cloud-only.

Wiz Research analyzes NordStellar logs to map credentials harvested by infostealers like Lumma and RedLine, showing how stolen keys and tokens unlock AWS, Azure, GitHub, and AI platforms.

Wiz earned Leader status in Forrester's Q3 2026 Proactive Security Platforms Wave, scoring 5.0/5.0 on 8 of 21 criteria, including cloud visibility, exposure validation, and remediation augmentation.

CrowdStrike launches an Agentic Identity Provider in Falcon Next-Gen Identity Security, giving every AI agent a trusted identity and continuously adaptive access instead of standing privileges.

Wiz's new Non-Human Identities Dashboard finds risky service accounts and machine identities—42% of organizations have one that is high-privilege, internet-exposed and vulnerable.

Wiz adds excessive-access findings for Google Cloud based on audit logs, letting all GCP customers—even without IAM Recommender—identify over-provisioned identities and right-size permissions.