Identity Threat Taxonomy

A structured way to group identity-related attack behaviours into related stages and patterns. It helps defenders understand how fraud unfolds across enrolment, authentication, recovery, and monetisation, so controls can be assigned to the right part of the identity lifecycle.

Expanded Definition

Identity threat taxonomy is a practical classification method for grouping identity-driven attack behaviours by stage, intent, and control failure. It is most useful when defenders need to separate enrolment abuse, authentication compromise, recovery takeovers, and post-access monetisation into distinct patterns that can be measured and blocked.

In NHI operations, the taxonomy should be anchored to how an identity is created, used, rotated, delegated, and revoked, not only to the attacker’s tooling. That distinction matters because a stolen API key, a hijacked service account, and a manipulated recovery path may all end in the same breach, yet each requires different telemetry, policy, and response. Guidance is still evolving across vendors, but the underlying pattern is clear: taxonomy becomes actionable when it maps attack behaviour to lifecycle controls rather than to generic “identity risk” labels. The closest external reference point for this style of categorisation is the MITRE ATLAS adversarial AI threat matrix, which shows how structured threat groupings improve detection and response design.

The most common misapplication is treating identity threat taxonomy as a reporting label, which occurs when teams classify incidents after the fact without tying each category to a specific control gap.

Examples and Use Cases

Implementing identity threat taxonomy rigorously often introduces extra classification overhead, requiring organisations to weigh better detection fidelity against the effort of maintaining consistent event mapping.

• An engineering team separates credential stuffing against human logins from token replay against service accounts, then routes each to different playbooks and alert thresholds. For background on how credential compromise escalates across identity surfaces, see Ultimate Guide to NHIs.
• A security operations team labels secret exposure, key misuse, and abnormal automation as different attack stages, which helps them distinguish discovery from active exploitation. This is especially important when analysing patterns similar to the 52 NHI Breaches Analysis.
• A platform team maps recovery-path abuse to identity proofing weaknesses, rather than treating it as a generic account takeover. That approach aligns more closely with the intent of CISA cyber threat advisories, which emphasise actionable defensive categorisation.
• A governance team groups monetisation behaviours such as resale, lateral movement enablement, and persistence establishment into one downstream phase, so incident reviews can show where value was extracted after access was gained.
• An AI operations team separates agent misuse from ordinary application abuse, because an autonomous agent with tool access changes the threat model and the containment strategy. Vendor research on AI-enabled intrusion patterns, including the Anthropic — first AI-orchestrated cyber espionage campaign report, reinforces why that distinction matters.

Why It Matters in NHI Security

Without a shared taxonomy, teams tend to undercount NHI incidents, merge unrelated events, and miss the real control failure. That creates blind spots across secrets management, PAM, RBAC, JIT access, ZSP, and recovery workflows, especially when identities outnumber humans by a wide margin. NHIMG research shows that Ultimate Guide to NHIs reports only 5.7% of organisations have full visibility into their service accounts, which means most defenders cannot reliably classify what they cannot see.

This is where taxonomy becomes a governance tool, not just an analyst convenience. It helps teams decide whether the failure was secret sprawl, excessive privilege, weak rotation, broken offboarding, or a recovery process that let an attacker pivot from one identity to another. It also supports trend analysis across incidents, so leadership can prioritise the controls that reduce repeated exposure rather than only the loudest alert. NHIMG’s Top 10 NHI Issues is useful here because it connects recurring NHI weaknesses to operational remediation, while the OWASP NHI Top 10 helps frame agent and secret abuse in a broader attack context.

Organisations typically encounter the full value of identity threat taxonomy only after repeated compromises reveal the same lifecycle weakness, at which point the taxonomy becomes operationally unavoidable to address.

Related resources from NHI Mgmt Group

• How should security teams use an identity threat taxonomy?
• Identity Blast Radius
• What is the difference between compliance-driven identity control and threat-centric identity control?
• When should organisations treat an identity event as an insider threat?