Organisations should audit valid-account usage, role scope, supplier access, remote administration paths, and any identity that can reach critical operations. The goal is to understand how far a compromised account could travel, not just where the first login happened.
What an identity-led attack audit should actually cover
The audit should reconstruct the attacker’s usable access, not just the initial compromise point. That means tracing which valid accounts worked, what each role could reach, whether supplier or third-party access expanded the blast radius, and which remote administration paths were available. The practical question is: once inside, what identities could move the incident toward sensitive systems or critical operations?
Start by separating identity evidence from endpoint evidence. A successful identity-led attack often leaves the attacker looking like an ordinary authenticated user, so the audit has to follow authentication events, privilege changes, session use, delegation paths, and account-to-account reach. That gives you the real privilege chain, which is usually more important than the first phishing click, token theft, or password reset that enabled it.
For service accounts, shared accounts, and supplier-managed access, the audit should show who owned the identity, how it was issued, whether it was still active, and whether its permissions were broader than the business process required. A compromised service path can expose far more than a single human login because it may already sit close to administration, automation, or data-plane trust.
How to trace the blast radius through identities and access paths
Good audit scope follows the path of authority. Review role assignments, group membership, standing privileges, conditional access exceptions, break-glass use, delegated admin rights, and any identity that can reach production, finance, support tooling, cloud consoles, directory services, or backup systems. If one identity can pivot into another, or if one account can invoke remote administration on behalf of others, that relationship belongs in the audit.
Supplier access deserves separate treatment because it often combines outside trust with elevated reach. Use Ultimate Guide to NHIs — Regulatory and Audit Perspectives to anchor review around access trails, governance evidence, and recertification, especially where third parties manage production workloads or automation. The question is not whether the supplier was “approved”, but whether the approved path was still the right size for the task at the time of compromise.
Remote administration paths are also a common escalation route. Audit VPNs, bastions, RDP, SSH, privileged jump hosts, privileged access workstations, directory admin tools, and any cloud or SaaS admin console that can reach critical systems. Where remote access is tightly integrated with identity, the attack may have used one valid login to reach a much larger administrative surface than the logs first suggest.
What good remediation evidence looks like after the audit
The audit outcome should let you prove three things: which identities were used, what each identity could access, and which pathways must be removed or constrained. In practice, that means documented account ownership, recent access reviews, current privilege scope, evidence of MFA or stronger authentication where relevant, and records of any temporary elevation or exception that existed during the incident.
For lifecycle-heavy environments, the most useful follow-up is often a reset of assumptions, not just passwords. NHI Lifecycle Management Guide is useful here because it frames discovery, ownership, rotation, offboarding, and visibility as one control loop. Even when the incident involved human accounts, the same discipline helps teams spot stale, orphaned, or overentitled identities that survive long after the original business need has changed.
Where identity sprawl or privilege overlap is present, compare the incident timeline against account inventory, admin group membership, and any identity that can authenticate across environments or tenants. Top 10 NHI Issues is a useful reference for the recurring failure modes to check, especially excessive permissions, stale access, shared accounts, and weak ownership over identities that can touch critical operations.
Risk and Threat Considerations
Identity-led attacks are dangerous because valid access is much harder to distinguish from normal activity than malware or noisy exploitation. If the audit stops at the first compromised login, teams often miss delegated privileges, supplier pathways, and remote admin channels that let the attacker move laterally or return later with the same trust relationship.
Failure mechanism: A valid account, service identity, or supplier credential can be used to traverse trust boundaries, inherit role scope, and reach systems that never appeared in the initial alert. Overlooked delegation or standing privilege can turn one compromised identity into repeated access.
Impact: The organisation underestimates blast radius, misses persistence paths, and leaves high-value operations reachable to the same access pattern that enabled the attack.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 sets the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-2 — Account Management | Auditing valid-account use and ownership requires account inventory and lifecycle control. |
| AC-6 — Least Privilege | Role scope and remote admin paths map to limiting excessive permissions and access paths. | |
| AU-6 — Audit Record Review, Analysis, and Reporting | Incident audits depend on reviewing logs to reconstruct account activity and reach. | |
| Recommendation — Review and remove accounts that no longer have a documented business need. Reduce standing access to the minimum needed for each role and task. Correlate authentication, privilege, and admin-use logs to rebuild attacker movement. | ||
| ISO/IEC 27001:2022 | A.5.18 — Access rights | Access-right review is central to auditing compromised identities and supplier access. |
| Recommendation — Verify, recertify, and revoke access rights that exceeded business need. | ||
Practitioner Guidance
What to prioritise: Start with identities that could reach production, administration, finance, directory services, backups, or cloud control planes. Those paths matter more than lower-value endpoints because they determine whether the attacker had operational leverage or only local access.
What to verify: Confirm account ownership, current privilege scope, recent use, and whether any supplier or remote-admin account had more access than the task required. If you cannot prove scope from logs and approvals, treat that identity as part of the incident surface rather than a benign support account.
Common mistake: Teams often focus on the compromised endpoint or phishing lure and never reconstruct the privilege chain. That leaves shared accounts, delegated admin, and cross-environment access untested, which is exactly where identity-led incidents tend to expand.
Practitioner takeaway: The useful audit question is not “which account was hit first?”, but “which identities could the attacker use to change the environment, and which of those still need to be removed or constrained?”
Related resources from NHI Mgmt Group
- What should organisations prioritise after a phishing-led compromise, email cleanup or identity containment?
- Why do non-human identities create more audit risk than human accounts?
- Why do non-human identities create audit risk in modern environments?
- When does a machine identity become a compliance problem?