- › Identity is the control plane now, so an access problem is a total-compromise problem rather than a scoping inconvenience.
- › Fix the leaver process before buying anything, because dormant accounts with live credentials are the cheapest thing an attacker can find.
- › Standing privilege is the multiplier: an admin account that is always admin turns any single phish into a domain problem.
- › Phishing-resistant factors stop credential theft and do nothing about a stolen session, which is a separate control with a separate button.
- › Machine identities outnumber human ones several times over in most estates, and almost nobody rotates them.
Every access review I have sat through has the same moment. Somebody pulls the list of accounts with administrative rights, the room goes quiet, and then a person says a name nobody recognizes. Three minutes later somebody works out that it belonged to a contractor who finished in 2023.
That account still authenticates. It still has the rights it was granted. Nobody removed it because removing things is nobody’s job, and the ticket that created it closed successfully two and a half years ago.
Identity and access management is a large category with an expensive vendor market, and most organizations enter it by buying a platform. The platform is fine. It will not find that contractor, because the platform was configured from the same records that lost him.
Why Identity Became the Whole Game
Think about what a perimeter used to do. Everything valuable sat inside a building or a data center, and the network boundary was a physical fact you could point at. Getting in meant getting past it.
That boundary is gone in most organizations, and identity replaced it. Your data sits in cloud tenants, your staff work from anywhere, your suppliers have portals into your systems, and the thing deciding whether a request succeeds is whether it carries a valid identity. The credential became the wall.
That has a consequence worth stating in plain terms. When the perimeter was a network, a breach gave an attacker a position they then had to expand. When the perimeter is identity, a breach gives an attacker the position directly, at whatever level that identity held. There is no separate escalation step if the account they took was already privileged.
To put it in blast radius terms: a compromised workstation in 2010 cost you a workstation. A compromised administrative identity in 2026 costs you whatever that identity can reach, which in a flat cloud tenant is close to everything, and it costs it in minutes rather than weeks.
The Order That Closes the Most Exposure
Programs stall because they start with the platform. The platform is step four or five. This sequence returns the most closed exposure per hour spent, based on what assessments keep finding.
1. Fix the leaver process
Before anything else, answer one question: when somebody leaves, how long until every one of their access paths is dead, and who confirms it?
Most organizations have a good answer for the main directory account and a bad answer for everything else. The software-as-a-service tool a department bought on a card. The shared mailbox. The vendor portal login. The Git repository they were added to individually. The virtual private network profile. The building badge.
The reason this goes first is economics. A dormant account with live credentials is the cheapest thing an attacker can find, because nobody is watching it, the owner will never report suspicious activity on it, and its use generates no complaint. Every other control you buy has to work against an adversary who is trying. This one works against an adversary who just walks in.
Build the list of every system that grants access, name an owner for each, and put a deprovisioning check on the offboarding form that a human signs. It is unglamorous and it beats a seven-figure platform that only knows about the systems somebody remembered to connect.
2. Kill standing privilege
Standing privilege means an account that holds administrative rights all the time, whether or not it is doing administrative work.
Consider the arithmetic from the adversary’s side. If your twelve administrators are permanently privileged, then twelve successful phishing attempts out of however many they send produce full control. If those same twelve people hold ordinary rights by default and elevate for a specific task, for a bounded window, with an approval, then a successful phish against one of them produces an ordinary user account and a much longer road.
That is the single biggest multiplier in this entire discipline. Just-in-time elevation is available in every major identity platform and most organizations that own the license have not turned it on, because turning it on requires deciding who approves and that decision is a meeting nobody schedules.
Separate the accounts too. An administrator should have a normal account for mail and browsing and a distinct one for privileged work, and the privileged one should never read email. Most administrative compromise arrives through an inbox, and the fix is that the inbox and the rights are not on the same identity.
3. Make the factor phishing-resistant
One-time codes and push prompts stop password reuse and casual credential stuffing, and they lose to a real-time proxy that relays the code, or to a user who approves the eleventh prompt at 1am.
Phishing-resistant factors, meaning hardware security keys and passkeys bound to the device, close that. The credential cannot be relayed because it is cryptographically tied to the origin it was registered against, so a lookalike domain gets nothing usable.
Roll it to the accounts in step two first. The full population comes later and costs more.
Be clear with yourself about what this buys, because it is a specific thing and not a general one. It defends the moment of authentication. It has no effect at all on an attacker who already has code running on the machine, which is the point of passkeys stop phishing and do not stop malware.
4. Treat the session as a separate control
This is the step almost every program skips, and it is why the earlier ones underperform.
Authentication happens once. The session it issues lives for days or months. An attacker who copies that session inherits the result of your authentication without ever performing one, so every control in step three has already run and passed before they arrive.
The practical work is short: know your session and refresh token lifetimes, be able to revoke sessions as a named action separate from a password reset, and confirm the revocation terminates an active session rather than waiting for a token to expire on its own. Most teams have never tested that last part. We covered the full version in resetting the password does not kill the session.
5. Find your machine identities
Now count the identities that are not people. Service accounts, application registrations, interface keys, continuous integration tokens, robotic process automation logins, the credential in the scheduled job somebody wrote in 2019.
In most estates these outnumber human identities by a factor of several, and they share a set of properties that should worry you. They rarely have multi-factor. They frequently hold broad rights because scoping them was hard and the deadline was Friday. They almost never rotate. And they have no human who notices when they behave strangely, because nobody owns them.
The 1.7 billion credentials that infostealers harvested in the first half of this year included plenty of these, pulled straight out of configuration files and browser stores.
Start with an inventory and an owner per identity. Then rotation, then scope reduction. This step is hard and takes quarters rather than weeks, which is exactly why it should not be step one, and exactly why it cannot be step never.
6. Now consider the platform
With the first five done, you know what you own, who holds what, and what your gaps are. That is the state in which a platform purchase makes sense, because you can specify what you need it to do.
Buy it first and you have automated the distribution of an access model nobody validated.
Getting the Reviews to Mean Something
Access reviews are the compliance artifact of this discipline and mostly a waste of everyone’s afternoon. A manager receives 140 rows, recognizes the names, and approves all of them, because the interface makes approving free and questioning expensive.
Three changes make them worth running.
Show what the access does, not what it is called. Nobody can evaluate a row that says a group name. They can evaluate a row that says this person can approve payments up to $50,000, or this person can read every customer record.
Sort by risk and cap the length. Twenty rows of real privileged access, reviewed carefully, beats 140 rows approved in bulk.
Default to removal. If the reviewer does not respond, the access lapses rather than persists. This inverts the incentive, and it is the only change on this list that reliably produces removals rather than confirmations.
What This Costs When It Fails
The business case is not abstract, because the failures are public and priced.
An identity compromise at a vendor propagates to everyone that vendor serves, which is the shape of the healthcare billing incidents we have covered all month, where one company’s breach became a notification obligation for thousands of practices. A dormant contractor account becomes the initial access in a ransomware incident whose recovery runs seven figures before anybody counts the downtime. An over-privileged service account turns a contained web application flaw into a full data set.
The pattern underneath all three is the same. The technical failure was small and the identity attached to it was large, and the size of the identity was a decision somebody made quickly, years earlier, with no review since.
For the broader architectural picture, zero trust as a phased implementation covers where this sits in a larger program, and our earlier identity and access management best practices covers the fundamentals at a more introductory level. For the physical half, badge and credential systems have the same standing-access problem and it is documented in access control credential cloning.
Start Here Tomorrow
Pull the list of accounts with administrative rights in your primary identity system. That one list, nothing else.
Read every name out loud. Every one you cannot immediately attach to a working human being is your finding, and you will have some.
That contractor from 2023 is still in there. Go look.
Want the full inventory built rather than guessed at? Contact Grab The Axe for an identity and access assessment, or start with our free Human Attack Surface Score.
Operating on the philosophy that 'you can't build a secure system if you don't know how to break it,' Chris leads our engineering division. A top 1% National Cyber League competitor, he hardens our digital infrastructure against the very exploits he has mastered.
View Author Page →
