Why it takes 11 hours to resolve one ID-related cyber incident | Computer Weekly

"Let's do a thought experiment. An identity-related security alert just flared up at an enterprise, perhaps a carmaker or an airport. It could be nothing, or the start of a ransomware attack about to force all infrastructure offline. How long would it take to trace the root cause of the alert? Minutes? Hours? It might shock you that according to a Teleport-commissioned study by Enterprise Strategy Group (ESG), it takes 11 hours on average for enterprises to resolve one identity-related security incident."

"Computing environments have become so absurdly fragmented that our inventions have created tech borders, not unlike national borders. Humans, machines, applications, and even AI agents now all have identities. In most organisations, they're scattered across systems, managed in isolation. Cloud platforms, on-prem servers, identity providers, developer tools, legacy systems, SaaS, databases, and Kubernetes clusters have become their own countries with their own rules, logs, and blind spots."

"Managing those identities would be like a customs officer tracking who's coming and going between countries with totally divergent passport systems, except a passport (your identity) in one country doesn't work in the rest. Consistency? Forget that. Some countries want your passport, others want a visa. Some have strict guards; others don't bother with credentials. The rest lost your files, to say nothing of the people with outda"

Identity-related security alerts take an average of 11 hours to resolve at enterprises. Attackers can pivot across infrastructure and escalate privileges within minutes, making long resolution times catastrophic. Modern computing environments are highly fragmented, creating technology borders where humans, machines, applications, and AI agents each hold identities scattered across cloud platforms, on-prem servers, identity providers, developer tools, legacy systems, SaaS, databases, and Kubernetes clusters. Each platform uses different rules, logs, and credential systems, producing blind spots and inconsistent identity controls. Security teams face difficulty tracing root causes quickly because identities and logs are siloed and managed in isolation.

Read at ComputerWeekly.com