Attackers are only as powerful as their permissions: Identity Security lessons from inside Mandiant

Episode Summary: Chris Linklater from Mandiant has spent his career helping organizations respond to cyber incidents, recover from breaches, and strengthen their security foundations. In this episode of Identity Decoded, he joins Roy Akerman and Rob Ainscough to unpack why identity has become one of the most common paths attackers use to gain access, move laterally, and exfiltrate data. Drawing from real-world incident response engagements, Chris explains why organizations often focus too narrowly on privileged accounts while overlooking the risks posed by everyday users, delegated permissions, and poorly governed group memberships. Together, they explore the growing importance of identity segmentation, asset visibility, and modernization, as well as why security teams need a deeper understanding of both human and non-human identities. Key Topics: 1. Attackers aren't breaking in, they're logging in 2. You can't protect what you don't understand: identities, assets, and dependencies 3. The hidden risks of delegated access and group sprawl 4. Modernizing identity for an AI-accelerated threat landscape 🎧 Episode Highlights [04:41]: Why attackers are increasingly "just logging in" [11:54]: The challenge of containing breaches without disrupting the business [17:20]: Why identity segmentation is as important as network segmentation [18:08]: The hidden risks of delegated access and group management [27:39]: What every organization should learn from a compromised user account 🔑 Key Takeaways: ● Most breaches begin with identity, not sophisticated malware. Attackers increasingly gain access through stolen credentials, phishing, and vishing, making legitimate logins one of the most common entry points into an organization. Securing identity is no longer just an IAM concern, it's a core security priority. ● Visibility determines how effectively an organization can respond to an incident. Teams that understand their identities, assets, permissions, and business dependencies can contain threats more surgically and recover faster. You can't protect what you don't know exists. ● Organizations spend a lot of time protecting privileged accounts, but ordinary users often present just as much risk. A compromised non-privileged account can still expose sensitive data, enable lateral movement, or create a path to escalation. Understanding what a regular user can access is one of the most valuable security exercises a company can undertake. 👤 Guest Spotlight: Chris Linklater Chris Linklater is a cybersecurity leader at Mandiant (part of Google Cloud) with deep experience helping organizations detect, investigate, and respond to some of the world's most complex cyber threats. Over the course of his career, he has worked at the intersection of incident response, threat intelligence, and security operations, advising enterprises on how to strengthen their defenses against an increasingly sophisticated threat landscape. Today, he helps organizations translate frontline threat insights into practical strategies for resilience and security transformation. Stay Connected: ● https://www.silverfort.com ● https://linkedin.com/in/rob-ainscough ● https://www.linkedin.com/in/roy-akerman ● linkedin.com/in/chris-linklater-0323729