Newsletter #8
Published: 14 October 2026
By Stan van Gemert | S10 Group
Series #2: The Governable Organisation
S10 Group Newsletter · Identity & Containment Series
Trust Has Become
The Blast Radius
Why the routes your organisation was designed to trust now define how far an incident can travel.
Executive summary
In the previous newsletter issue, “The Organisation Moves Slower Than The Attack”, I explored why a credible alert can arrive before your organisation is ready to act. Security teams may recognise harmful activity while authority and the operational consequences of intervention are still being worked through. The delay gives an attacker more time to progress.
Newsletter #8 takes the next step: what can an attacker reach while those decisions are being made?
I want to examine how the accounts, supplier connections and support tools your organisation relies on can carry a compromise beyond its starting point. The permissions attached to that access help shape the blast radius across data, systems and essential services.
Newsletter #8 takes the next step: what can an attacker reach while those decisions are being made?
I want to examine how the accounts, supplier connections and support tools your organisation relies on can carry a compromise beyond its starting point. The permissions attached to that access help shape the blast radius across data, systems and essential services.
From decision delay to the reach of an attack
A cyberattack does not always have to break through another barrier to reach the next system. Once an attacker takes over an administrator account or a supplier session, some of the necessary access may already be there. A supplier needs to maintain a service, an administrator needs to resolve a problem and an application needs to exchange data. Those are sound business reasons for granting access. The difficulty begins when access granted for legitimate work remains available after signs of compromise emerge.
Look at the connections between systems
For this discussion, trust has a specific meaning. It is the authority given to an identity, the systems a supplier may administer and the actions a tool is allowed to perform. A successful login confirms that the presented credentials were accepted. It does not, on its own, establish that the person using them is still acting on your behalf.
An administrator account might reach production servers and the console used to manage backups. A remote support tool may serve several locations. A shared data channel can expose information beyond the original application, while access to a virtual host or cloud console may affect many dependent workloads. Automated services and AI agents add identities whose permissions also need an owner and a defined purpose.
Start with one connection your organisation depends on. What could an attacker reach through it, who can authorise restricting it, and what would that decision mean for essential services? Reviewing each area separately can miss the point where one grants access to another. An account may have modest permissions until it connects to a management tool that can issue commands across a much larger environment.
Microsoft’s Digital Defense Report 2026 draws attention to unnecessary privileges and persistent access, including access held by applications and agents. Black Kite’s 2026 Third-Party Breach Report found an average of 5.28 publicly named downstream victims per vendor breach in its 2025 dataset. For me, those findings reinforce a practical concern: the consequences of a compromise can extend through connections that were already approved.
An administrator account might reach production servers and the console used to manage backups. A remote support tool may serve several locations. A shared data channel can expose information beyond the original application, while access to a virtual host or cloud console may affect many dependent workloads. Automated services and AI agents add identities whose permissions also need an owner and a defined purpose.
Start with one connection your organisation depends on. What could an attacker reach through it, who can authorise restricting it, and what would that decision mean for essential services? Reviewing each area separately can miss the point where one grants access to another. An account may have modest permissions until it connects to a management tool that can issue commands across a much larger environment.
Microsoft’s Digital Defense Report 2026 draws attention to unnecessary privileges and persistent access, including access held by applications and agents. Black Kite’s 2026 Third-Party Breach Report found an average of 5.28 publicly named downstream victims per vendor breach in its 2025 dataset. For me, those findings reinforce a practical concern: the consequences of a compromise can extend through connections that were already approved.
Identity and supplier reach
Microsoft’s Digital Defense Report 2026 describes identity security as spanning people, applications and agents, and recommends stronger privileged-access enforcement. Its report also examines how AI expands access to sensitive data. The implication for this newsletter is to review the permissions attached to automation alongside those granted to people.
Black Kite’s 2026 Third-Party Breach Report presents an analysis of 136 verified third-party breach events. Its downstream-victim figure describes the incidents it studied, rather than predicting the outcome of every supplier breach. The report provides useful context on how shared dependencies distribute consequences across customer organisations.
Sources:
Microsoft - Microsoft Digital Defense Report 2026
Black Kite - Third-Party Breach Report 2026
https://blackkite.com/reports/third-party-breach-report-2026
View more details
Close more details
When essential equipment outlives its security support
Reports on 12 and 13 October of cybersecurity incidents affecting retailers in France, Belgium and the Netherlands caught my attention because their consequences reached directly into everyday operations. In France, attacks on supermarket refrigeration systems forced stores to discard fresh and frozen products. Le Monde reported that national losses were expected to reach at least several million euros, although the total remained unknown. Separately, Albert Heijn halted operations at several distribution centres after taking systems offline. Its chief executive warned that disrupted replenishment could leave gaps on shelves, particularly for fresh products.
Alongside the immediate losses, the French refrigeration attacks highlight the risk of controllers running outdated or unsupported firmware. Danfoss had already documented the end of support for older controllers that no longer receive security updates. Other, supported models can remain exposed when available updates have not been installed.
That distinction matters for hospitals too. Installing an available update and protecting essential equipment for which no supported update exists require different responses.
Hospitals face a comparable constraint with some connected medical equipment. A device may still perform its clinical function while its firmware, operating system or supporting software has become obsolete. A manufacturer-supported update may be unavailable, and replacing essential equipment can require funding, planning and changes to clinical operations. The hospital still needs the device, even though its technical exposure cannot be removed through a routine patch.
For me, that is where the containment discussion becomes concrete. When an update is unavailable, your organisation needs to restrict how the equipment can be reached, detect suspicious access and identify attempts to move between connected devices, support servers and other critical systems. Compromised administrative sessions or server access must be interruptible before the attacker gains additional reach. Clinical and technical teams also need to understand what restricting those connections will mean for care.
Detection has to lead to an executable response. Recognising an intruder or lateral movement creates an opportunity to act; containing the compromised access can help prevent the initial foothold from becoming a wider incident. The response needs to match the activity and the systems involved, with device-specific safeguards and clinical safety decisions remaining essential.
The healthcare relevance is therefore immediate. Your organisation may be unable to modernise every vulnerable device before the next incident, but it still needs practical ways to detect misuse and contain attack progression through the surrounding environment while that equipment remains in service.
The same logic applies to recovery. Bringing systems back online is not only a technical sequence; it is a trust decision. In the Albert Heijn case, public reporting now points to an operational recovery priority: systems supporting store replenishment first, and only when the company is confident they can be reactivated safely. That is the practical version of recoverable trust. The question is not simply which system can be restarted fastest, but which connection can be restored with enough assurance that it will not reopen the incident.
Alongside the immediate losses, the French refrigeration attacks highlight the risk of controllers running outdated or unsupported firmware. Danfoss had already documented the end of support for older controllers that no longer receive security updates. Other, supported models can remain exposed when available updates have not been installed.
That distinction matters for hospitals too. Installing an available update and protecting essential equipment for which no supported update exists require different responses.
Hospitals face a comparable constraint with some connected medical equipment. A device may still perform its clinical function while its firmware, operating system or supporting software has become obsolete. A manufacturer-supported update may be unavailable, and replacing essential equipment can require funding, planning and changes to clinical operations. The hospital still needs the device, even though its technical exposure cannot be removed through a routine patch.
For me, that is where the containment discussion becomes concrete. When an update is unavailable, your organisation needs to restrict how the equipment can be reached, detect suspicious access and identify attempts to move between connected devices, support servers and other critical systems. Compromised administrative sessions or server access must be interruptible before the attacker gains additional reach. Clinical and technical teams also need to understand what restricting those connections will mean for care.
Detection has to lead to an executable response. Recognising an intruder or lateral movement creates an opportunity to act; containing the compromised access can help prevent the initial foothold from becoming a wider incident. The response needs to match the activity and the systems involved, with device-specific safeguards and clinical safety decisions remaining essential.
The healthcare relevance is therefore immediate. Your organisation may be unable to modernise every vulnerable device before the next incident, but it still needs practical ways to detect misuse and contain attack progression through the surrounding environment while that equipment remains in service.
The same logic applies to recovery. Bringing systems back online is not only a technical sequence; it is a trust decision. In the Albert Heijn case, public reporting now points to an operational recovery priority: systems supporting store replenishment first, and only when the company is confident they can be reactivated safely. That is the practical version of recoverable trust. The question is not simply which system can be restarted fastest, but which connection can be restored with enough assurance that it will not reopen the incident.
The current retail incidents
Ahold Delhaize’s 13 October statement described its investigation and controlled relaunch. It said there was no indication at that time that customer or associate data had been taken; that remains a dated statement from an ongoing investigation.
CERT-FR confirmed numerous compromises of remote refrigeration controllers. Its guidance includes removing internet exposure, checking configurations and restoring access through a secured VPN or protected network. It warns that resetting vulnerable equipment while leaving it exposed can lead to renewed compromise. Equipment recovery therefore also requires attention to the connection through which it is managed.
Sources:
Ahold Delhaize - cybersecurity update dated 13 October 2026
https://newsroom.aholddelhaize.com/update-on-ahold-delhaizes-cybersecurity-incident/
CERT-FR - refrigeration-controller alert updated 13 October 2026
View more details
Close more details
Availability can make restriction harder
A suspect supplier session may still be doing useful work. Closing it could remove access to a specialist who is needed to maintain a service. An administrator account may support routine changes as well as the activity under investigation. Those dependencies explain why restricting access can become a difficult operational decision.
I would be concerned if the difficulty only became visible during the incident. A team may know how to terminate a session but have no workable alternative for the service it supports. Another may have an alternative but lack authority to use it. The account remains active while the organisation works out what will happen if it is closed.
Keeping a connection open is also a decision. Its consequences depend on what the account can reach and what the attacker is already doing through it. Your teams need enough understanding of the dependency to compare the disruption of restricting access with the additional damage that continued access could allow.
Make critical access narrowable, interruptible and recoverable
For me, the practical standard is that trust must be narrowable, interruptible and recoverable. Each word describes a different action, and each deserves a specific answer for the account or connection involved.
Narrowable means reducing what the connection can reach. A supplier may still need access to one system while access to other sites or administrative functions is suspended. Your organisation needs to know whether that separation is technically possible and whether the supplier can continue the necessary work within it.
Interruptible means being able to stop a harmful session or activity with its service effects understood. The responsible team needs an available mechanism, authority to use it and a plan for the work that will be interrupted. Some situations require a broader shutdown, but that should follow from the incident and its consequences rather than from having no more precise option.
Recoverable means agreeing how access can be restored safely. Reconnecting a service, replacing compromised credentials and checking the integrity of the affected environment are related tasks, but completing one does not automatically complete the others. Demand for the service may return before the conditions for restoring its access have been met.
Start with one connection your organisation depends on
I would begin with an hour around one consequential connection, rather than trying to review the entire environment in one meeting. Choose an administrator account, supplier session or management console whose compromise could affect an essential service. Bring together the people who understand its access and the people who depend on its work.
Use the first ten minutes to map what it can reach. Spend fifteen minutes agreeing what signs of misuse would justify a restriction, then fifteen walking through the first action and its likely service impact. Use the next fifteen to define the conditions for reconnection, and the final five to assign unresolved dependencies to named owners.
The discussion should produce a specific next step. If the team assumes a session can be terminated, arrange an appropriately scoped technical check. If the service cannot continue without that session, work through the operating alternative. The discussion identifies what needs validation; it does not by itself validate the technical response or the wider continuity plan.
How our platform contributes
Our Ransomware Containment platform provides a defined intervention when illegitimate file encryption begins. It agentlessly monitors file activity across the protected data environment and isolates the responsible user, session or device, helping prevent encryption from spreading further through protected data.
Additional Server Intrusion Protection (SIP) and Virtual Server Protection (VSP) features run on that platform. SIP extends protection to compromised server access, while VSP addresses attacks directed at supported hypervisor environments.
These capabilities give incident and infrastructure teams ways to contain specific harmful activity while the wider investigation and operational response continue.
WHAT CONTAINMENT CHANGES
Early containment limits the attacker’s reach before more data, systems and shared infrastructure are affected. It preserves the operational capacity your organisation needs to keep essential services running while your teams investigate the intrusion, stabilise the environment and recover affected systems.
The broader questions in this newsletter still require work across access management, supplier relationships and operational planning. Our platform does not make every connection narrowable or decide when equipment can safely be disconnected. Those decisions need the responsible teams and an understanding of the services involved.
The question I would take into your next discussion
A long list of approved accounts and suppliers tells you who was granted access. The more useful conversation for this issue is what one compromised connection could reach, what essential work depends on it and how that access could be changed while an incident is developing.
The next horizon
In the next issue, "The First Hours Are No Longer Internal", I will look at what happens when customers, regulators and other stakeholders need explanations while the investigation is still developing. Before that pressure arrives, it is worth finding the connection for which your teams cannot yet answer the question above. I would welcome hearing where that difficulty lies in your organisation.
Inspired by and further reading
AP - report on European supermarket cyberattacks dated 13 October 2026
https://apnews.com/article/78a813a8efd466b360655339f96083dc
FDA - medical device cybersecurity guidance and resources
https://www.fda.gov/medical-devices/digital-health-center-excellence/cybersecurity
Dutch Parliament - summary of questions on the nationwide Albert Heijn disruption, dated 13 October 2026
Lemonde - A disastrous day for French supermarkets after massive cyberattack targets refrigeration systems
https://www.lemonde.fr/en/economy/article/2026/10/13/a-disastrous-day-for-french-supermarkets-after-massive-cyberattack-targets-refrigeration-systems_6758535_19.html?utm_source=chatgpt.com
Unit 42 - case study on third-party-managed gateway access at a European bank, dated 13 October 2026
https://unit42.paloaltonetworks.com/noise-inside-network-third-party-risk/
This case is useful context for the newsletter because it shows how compromised credentials and a supplier-managed gateway can turn trusted access into internal reconnaissance, documentation exposure and attempted expansion of control before further movement is contained.
Hear first when a new S10 Group release is published
Would you like to receive a short note when S10 Group publishes a new article or newsletter?
Leave your name and email address below. We will send a short update when a new release is available, with a brief summary and a direct link to the publication.
Leave your name and email address below. We will send a short update when a new release is available, with a brief summary and a direct link to the publication.
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
FOCUSED RANSOMWARE RESILIENCE ASSESSMENT
Compare controlled file-encryption scenarios with your existing security controls active, first without Ransomware Containment and then with it. The assessment itself is limited to encryption, but alongside the assessment results, we can explain how our platform and its additional Server Intrusion Protection and Virtual Server Protection features, help detect and interrupt lateral movement, reduce the risk of data theft, protect remote server access and defend virtual environments such as VMware and Hyper-V. That makes the session useful not only as a ransomware-containment test, but also as a practical discussion about what your organisation can still control when identity, privilege and infrastructure trust come under pressure.
Further readings
Previous S10 Group newsletter arc
17 March 2026 - #01: The Odido lesson:
The Odido Lesson →
Return to the identity-trust lesson: access may continue to work even after the organisation can no longer trust what that access represents.
08 April 2026 - #02:
When the Vendor Is Non-Negotiable →
Explore how dependency on critical suppliers can reduce room to manoeuvre when trust becomes uncertain.
14 May 2026 - #03:
The First Hour: Who Is Allowed to Act? →
Revisit the decision-rights question that determines whether the first hour produces action or delay.
17 June 2026 - #04:
Detection Is Not Control →
Understand why detection only matters when the organisation can safely turn signals into action.
15 July 2026 - #05:
Retention Drift →
Retention drift: the breach multiplier nobody decided on, using incident evidence and strategic analysis to explain trust, containment, governance and operational resilience under cyber pressure.
15 July 2026 - #06:
Resilience Has Become a Governability Question →
Read how NIS2 and governability turn resilience from a technical ambition into an executive control question.
16 September 2026 - #07:
The Organisation Moves Slower Than the Attack →
See why escalation alone cannot contain an attack, and how pre-agreed, bounded authority turns a credible signal into action before the containment window closes.
Stop the cascade
PAGE NAVIGATION
FURTHER READINGS