They end up with inventory without defensible awareness. A team may know what exists, yet still miss which identities can reach which systems, which paths are exposed externally, or where a compromised account can move next. Visibility without path-level context leaves containment decisions too late.
Why inventory is not the same as reachability
The break is in the security model, not the asset list. Inventory tells you what exists; reachability tells you which identities can actually touch it, by which route, and under what authority. Once those path relationships are missing, the team can count systems but still fail to see the real blast radius of a compromised account or overexposed integration.
This is why control decisions become weaker even when discovery looks complete. You may know a server, database, or service is present, yet miss whether it is reachable from the internet, from a partner network, or from a broadly trusted identity path. The result is a false sense of coverage, because the missing layer is the one that connects assets to action.
That gap is especially important in environments with hybrid administration, service accounts, workload identities, or delegated tooling. Active Directory and Entra ID Hardening Guide is useful here because reachability is often shaped by privilege boundaries, delegation, and tiering, not just by host visibility.
Where containment fails when path context is missing
Without identity reachability, the defender cannot reliably answer the next containment question: which accounts, tokens, or delegated services can move from one asset to another. That matters because the same system can be low risk in isolation and high risk when reachable from a privileged, shared, or externally exposed identity path.
This is the point where lateral movement and privilege abuse become harder to contain. A host may be “known,” but if its reachable paths are not mapped, a compromise can spread before responders understand which trust relationships need to be cut first. The weak point is often not the asset itself, but the unexamined route into it.
For identity-heavy estates, Ultimate Guide to NHIs gives the broader context for why service, application, and workload identities create reachability that asset inventories alone do not capture.
That same blind spot is why path-level exposure work must sit next to inventory, not underneath it. Top 10 NHI Issues is a helpful reference when you need to think about visibility, ownership, rotation, and overprivilege as linked problems rather than separate tasks.
What defenders should measure instead of only counting assets
Practitioners need a view of who can reach what, from where, and with what effective permissions. That means connecting asset discovery with identity graphing, segmentation checks, external exposure review, and privilege path analysis. The useful question is not “do we know the asset exists?” but “can an attacker or overbroad identity reach it, and can we prove the route?”
In practice, the most useful evidence is a map of reachable paths for high-value systems, plus a way to show which identities can traverse those paths today. If that cannot be produced quickly, the organisation does not really have containment readiness. It has catalogue completeness without operational visibility.
Ultimate Guide to NHIs — Standards is relevant because this kind of control depends on zero trust, workload identity, and identity security practices that make path reachability observable rather than assumed.
Risk and Threat Considerations
When organisations can see assets but not identity reachability, they tend to underestimate exposure, delay containment, and miss the paths most likely to be abused after compromise. The practical risk is not only incomplete awareness, but also an inability to distinguish harmless inventory from reachable attack surface.
Failure mechanism: Asset discovery stops at presence, while identity and trust relationships remain unmapped, so exposed paths, delegated access, and lateral movement routes stay hidden until an incident forces discovery.
Impact: Responders isolate too late, overtrust internal paths, and can neither prove blast radius nor prioritise the accounts and routes that matter most for containment.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST SP 800-53 Rev 5, NIST Zero Trust (SP 800-207), CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Reachability depends on effective permissions and privilege boundaries. |
| Recommendation — Enforce least privilege so asset reachability tracks only approved access paths. | ||
| NIST Zero Trust (SP 800-207) | Zero Trust Architecture | The subject is about verifying who can reach assets through trust paths. |
| Recommendation — Continuously verify each access path instead of assuming internal reachability is safe. | ||
| CIS Controls v8 | CIS-6 — Access Control Management | Managing who can reach systems is central to reducing exposure from hidden paths. |
| Recommendation — Inventory and review access paths to remove unnecessary reachability. | ||
| NIST CSF 2.0 | ID.AM-01 — Physical devices and systems within the organization are inventoried | Inventory is the starting point, but the question highlights why inventory alone is insufficient. |
| Recommendation — Extend inventory work to include reachability and trust-path context. | ||
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | Non-human identities often create hidden reachability through excessive access. |
| Recommendation — Reduce overprivileged non-human identities that expand asset reachability. | ||
Practitioner Guidance
What to prioritise: Treat path reachability as a control objective, not a nice-to-have analysis. The first priority is the set of systems whose compromise would change containment decisions, then the identities and integration paths that can reach them.
What to verify: For each critical asset, verify whether access is direct, delegated, inherited, or exposed through service credentials, and confirm that the answer is evidence-based rather than inferred from network location or directory membership.
Practitioner takeaway: If you cannot show the reachable paths, you do not yet know the attack surface, even if the inventory is accurate.
Related resources from NHI Mgmt Group
- What breaks when critical assets are reachable through standing identity access?
- What breaks when organisations rely on backup without proving clean identity recovery?
- What breaks when organisations cannot see access posture across users, applications, and assets?
- What breaks when organisations cannot see or revoke all connected apps in a cloud identity environment?