NexLINKEDIN ARCHIVE / Security
Interconnected cyber risk crosses organizational boundaries
Microsoft published an interesting piece this week on preparing governments for an era of interconnected cyber risk.
By Phil Kinsley
Adapted and republished on Nexlinks. The publication date is the original article date; the text is preserved as historical author commentary.
Date derived from the original LinkedIn post identifier, shown in America/New_York time; the export supplied only a relative age.
Historical author commentary. Statements and links reflect the original period; this import is not a new factual verification of every historical claim.
Microsoft published an interesting piece this week on preparing governments for an era of interconnected cyber risk.
The government angle is useful, but the underlying point feels much broader than that.
A lot of the customer conversations I’m having lately reinforce the same thing. We still tend to separate identity, endpoint, cloud, SaaS, data, third-party risk and now AI into different security conversations. In practice, incidents rarely stay within those boundaries.
A compromised identity can become access to another application, another account, cloud resources, sensitive data or a trusted third party very quickly.
Microsoft’s 2026 Digital Defense Report found that 52.2% of intrusions involving valid accounts resulted in additional credential theft. Phishing was also observed in 23% of intrusions, up from 7% the previous year.
That lines up with what I think many security teams are already seeing. An identity incident is often just the starting point.
AI agents add another dimension to this. They can have identities, access data, call applications and interact with other systems, often across the same boundaries we have historically managed separately.
That is where the idea of interconnected cyber risk becomes useful outside government too.
A few practical places I would start:
- Map the paths between identities, applications, cloud resources and sensitive data, not just the individual controls around each one.
- Treat identity compromise as a wider investigation. Look at tokens, sessions, privilege changes, application access and what the account touched next.
- Review third-party and application permissions with the same attention as human identities.
- Apply the same thinking to AI agents. Understand what each agent can access, what it can do and which systems it can call.
- Make sure your SOC can correlate activity across identity, endpoint, cloud, email and data instead of investigating each source separately.
The question is not just whether an individual control worked. Its if the organization understands what a compromised identity, application, supplier or agent can reach next, and whether the security team has enough visibility across those connections to respond early.
Original publication
Original LinkedIn post ↗Original writing supplied by the author. Feed cards, repeated article announcements, and provider promotion have been removed. Consult current primary documentation before acting on historical technical guidance.