What do organisations get wrong about post-compromise identity risk?

They often focus on entry control and underweight what happens after access is granted. In reality, attackers use the account to create mailbox rules, read messages, manipulate MFA settings, and pivot into trusted relationships. If you only measure login success, you miss the phase where the real damage happens.

Why This Matters for Security Teams

Post-compromise identity risk is where account abuse becomes operational impact. Once an attacker has a valid identity, the next move is rarely another login attempt. It is mailbox rule creation, token theft, MFA reset abuse, privilege expansion, and trusted-relationship pivoting. That is why login success metrics and perimeter alerts miss the phase that matters most.

NHI Management Group’s Ultimate Guide to NHIs shows how common identity mismanagement is in practice, and the same pattern applies after compromise: organisations often know an identity was used, but not what it was allowed to do next. The problem is not only detection. It is understanding how much damage a single identity can still cause after access has already been granted. Guidance from the NIST Cybersecurity Framework 2.0 reinforces that resilience depends on response and recovery, not just prevention.

In practice, many security teams encounter mailbox abuse, lateral movement, or persistence only after customer data, finance workflows, or admin trust has already been touched.

How It Works in Practice

Effective post-compromise identity risk management starts with treating identity as an active attack surface, not a one-time authentication event. The first question is not “Did the attacker log in?” but “What actions can this identity take, what relationships does it inherit, and what traces should those actions create?” That shift matters because adversaries often use legitimate permissions to move quietly through email, file shares, SaaS admin panels, and identity providers.

Practically, teams need layered controls that cover both humans and NHIs. Use the 52 NHI Breaches Analysis to see how compromise patterns repeat when secrets, service accounts, and delegated access remain over-privileged. For human identities, focus on mailbox auditing, MFA reset monitoring, OAuth consent abuse, session revocation, and impossible trust transitions. For NHIs, review token lifetime, secret rotation, service-account permissions, and whether credentials can be replayed outside the intended workload.

At a minimum, post-compromise review should include:

• Mailbox rules, forwarding changes, and suspicious delegated access.
• MFA method changes, recovery-option edits, and device registration events.
• Privilege escalation, role assignment, and consent grant activity.
• Token issuance, refresh-token reuse, and unusual API calls.
• Trust pivots into shared drives, ticketing systems, CI/CD, and privileged admin accounts.

This is also where modern identity telemetry helps. Continuous evaluation, short-lived credentials, and strong session controls reduce the time an attacker can remain invisible. Current guidance suggests that post-compromise containment should prioritise revocation and relationship mapping before broad password resets, because blind resets can miss persistent tokens and delegated access. These controls tend to break down in federated SaaS environments because session state, audit coverage, and revocation behaviour are inconsistent across providers.

Common Variations and Edge Cases

Tighter identity monitoring often increases alert volume and investigation overhead, requiring organisations to balance visibility against analyst fatigue. That tradeoff is especially real when multiple identity planes overlap, such as Entra ID, Google Workspace, VPN, HR systems, and NHI-heavy automation.

There is no universal standard for post-compromise identity scoring yet, so teams should be explicit about whether they are measuring blast radius, dwell time, or likelihood of re-use. The biggest edge case is delegated trust: an account may look low privilege on paper but still control email routing, shared inboxes, API grants, or downstream automation. Another common failure mode is assuming that compromised credentials are the only issue, when the real risk is persistence through refresh tokens, app consent, or recovery channels.

That is why the Ultimate Guide to NHIs and the Top 10 NHI Issues both emphasise lifecycle control, privilege reduction, and fast revocation. In mature programs, post-compromise identity risk is treated as a standing discipline, not an incident-only task.

The approach breaks down when organisations lack complete identity inventories, because they cannot reliably tell which accounts, tokens, and service relationships are still active.

Related resources from NHI Mgmt Group

• What do organisations get wrong about MFA and email compromise?
• What do organisations get wrong about measuring non-human identity risk?
• What do organisations get wrong about AI identity risk?
• What do organisations get wrong about identity risk visibility?