Why a Simple “Who” Question Exposes a Critical Cybersecurity Gap

The Hacker News recently highlighted an expert webinar focused on how identity blind spots put security operations centers, or SOCs, at risk. The core issue is straightforward: security teams can see suspicious activity, but they often cannot quickly determine who or what is behind it. This might be a human employee, a machine service account, or an AI agent with permissions that have not been reviewed recently.

This is significant because knowing "what" happened is not the same as knowing "who" did it and "what damage they could cause." For any business, a security alert is only useful if you can act on it intelligently. Without identity context, a small incident can become a major data breach because responders are flying blind.

The Growing Threat of Non-Human Identities in Australian Systems

The conversation around identity blind spots is expanding rapidly due to the rise of automation. Australian businesses are increasingly reliant on service accounts, API keys, and automated workloads that act without direct human control. These non-human identities often hold significant access to critical systems, and they are not always tracked with the same rigor as employee logins.

When these machine identities are compromised, the threat is that attackers can move laterally through a network using legitimate credentials. The challenge for security teams is not just detecting the unauthorized use, but understanding the full "blast radius"—or the extent of what that identity can touch. If a service account is blocked incorrectly, it can break critical business processes; if it is left alone too long, the attacker gains more ground. This is a delicate balancing act that requires the right context.

What This Means for Australian SMBs

For many Australian small and mid-sized businesses, the idea of a dedicated, 24/7 SOC is unrealistic. However, the principles from this discussion still apply directly to their cybersecurity posture. An SMB might rely on a managed service provider or a single IT manager, which means the margin for error is even thinner. A data breach can be devastating to a smaller operation, so understanding exactly who holds the keys to your data is not optional.

The takeaway for Australian businesses is that investing in tools which integrate identity management with threat detection is a strategic necessity, not just an enterprise luxury. You do not need a massive team, but you do need the process and technology to answer the question, "If this account is compromised, what is at risk?" This visibility is the difference between a quick recovery and a prolonged incident that costs time, money, and customer trust.

What You Can Do Now

  • Conduct an identity audit and review who—or what—has access to your most sensitive data, including service accounts and API keys.
  • Implement strict access controls based on the principle of least privilege, ensuring no user or machine has more access than necessary.
  • Require multi-factor authentication (MFA) not just for employees, but for critical machine identities where possible, to reduce the risk of credential misuse.
  • Ensure your monitoring tools provide context-rich alerts, so you know the owner and permission level of any identity triggering a security flag.
  • Develop an incident response playbook that specifically covers compromised credentials, outlining how to contain threats without disrupting essential business operations.

Improving your security operations does not have to be overwhelming. MS&VG helps Australian small and mid-sized businesses build practical, identity-aware security strategies that connect the dots between who has access and what is at risk, ensuring your team is prepared to respond with confidence when it matters most.