Unauthorised access is entry into a system, account, meeting, or data set without proper permission. In the context of video calls, it includes attackers or impostors joining conversations, hearing sensitive information, or influencing decisions after defeating weak identity checks. It is both a security and fraud risk.
Expanded Definition
Unauthorised access occurs when a person, application, or agent reaches a resource without the permission required by the owning system or policy. In NHI security, the term often covers more than a classic account login: it can include API keys used outside their intended scope, service accounts invoked by the wrong workload, or meeting links entered after weak identity checks. The practical distinction is that the access itself may look technically successful while still violating policy, trust boundaries, or business approval rules.
Usage in the NHI and IAM domain is still evolving across vendors, especially where AI agents, delegated tooling, and federated credentials blur the line between authorised execution and misuse. The OWASP Non-Human Identity Top 10 treats weak credential handling and over-privilege as core conditions that enable this outcome, while NIST SP 800-53 Rev. 5 Security and Privacy Controls frames the same risk through access enforcement, auditability, and least privilege. The most common misapplication is treating any successful authentication as authorised access, which occurs when entitlement scope, context, or session purpose is not verified.
Examples and Use Cases
Implementing unauthorised-access controls rigorously often introduces additional friction, requiring organisations to balance fast collaboration and automation against stronger verification, narrower entitlements, and tighter monitoring.
- A contractor joins a sensitive video meeting after a link is forwarded, hearing roadmap details despite never being approved for the session. The event matches patterns discussed in NHIMG’s 52 NHI Breaches Analysis, where weak identity assumptions repeatedly expand blast radius.
- An AI support agent uses a compromised token to query customer records outside its intended task scope, turning delegated access into misuse. This is a direct application concern in the OWASP Non-Human Identity Top 10.
- A service account inside CI/CD reads secrets from a repository because the credential was stored in code and inherited excessive privileges.
- A cloud workload accepts a stolen SAS key and exposes storage objects to an external actor, similar to NHIMG’s Microsoft SAS Key Breach reporting.
- An employee uploads a meeting link to an external chat channel, and a third party enters a board call without passing identity checks.
Why It Matters in NHI Security
Unauthorised access is often the visible end state of failures in secret storage, entitlement design, revocation, and monitoring. NHIMG reports that 97% of NHIs carry excessive privileges, which materially broadens the attack surface and makes a single exposed credential far more dangerous than a simple login failure. NHIs also outnumber human identities by 25x to 50x in modern enterprises, so even small control gaps scale quickly across automation, integrations, and AI-driven workflows. These conditions mean the risk is not only who entered, but what that identity could reach once inside.
Industry guidance from NHIMG’s Ultimate Guide to NHIs and the related Ultimate Guide to NHIs – Key Challenges and Risks shows that visibility and rotation failures are central drivers of this problem, especially when secrets remain valid long after exposure. Practitioners should interpret unauthorised access as a governance issue, not only an incident response event, because the same weakness often affects many identities at once. Organisations typically encounter the operational cost only after a breach, forwarded meeting link, or compromised token is abused, at which point unauthorised access becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST SP 800-63, NIST Zero Trust (SP 800-207) and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 | Unauthorised access often results from weak auth and over-privileged NHI controls. |
| NIST CSF 2.0 | PR.AC-1 | Identity and credential management directly governs who may access resources. |
| NIST SP 800-63 | IAL/AAL | Identity assurance levels define how strongly access should be bound to an entity. |
| NIST Zero Trust (SP 800-207) | Zero Trust assumes no implicit access, even after initial entry. | |
| NIST AI RMF | AI risk governance covers misuse of agents and delegated tools that access data. |
Verify NHI authentication paths, scope permissions tightly, and block token reuse outside intended context.
Related resources from NHI Mgmt Group
- Who is accountable when middleware bypass leads to unauthorised access?
- Who is accountable when a connected app grants unauthorised access to data?
- Who should be accountable when automated provisioning creates unauthorised access?
- Who is accountable when zero trust controls fail to stop unauthorised access?
