TL;DR: Identity risk now extends beyond core directory tiering because attackers can use legitimate credentials and trusted relationships to reach backup, recovery, regulated data and other critical assets, according to SpecterOps. The practical shift is from protecting a directory boundary to continuously mapping relationships and choke points that create attack paths.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on SpecterOps's blog post: Identity risk extends beyond tier zero because legitimate credentials and trusted relationships can still create attack paths to critical assets.
Why it matters: IAM, PAM and NHI teams need to treat relationship mapping and attack path reduction as an operating requirement, not a one-time directory hardening exercise.
Context
Tier zero is no longer the only identity boundary that matters. In modern environments, the more important problem is how legitimate access chains connect ordinary identities to assets that must stay resilient, such as backup systems, recovery infrastructure, regulated data and critical workloads.
Attack path management gives security teams a way to model those connections instead of relying on static tier labels alone. It asks which relationships create reachable paths, which boundaries are illusory, and which choke points collapse exposure fastest when they are removed.
Key questions
Q: How do teams map identity attack paths to critical assets?
A: Teams map identity attack paths by tracing how accounts, groups, trusts, tokens, and delegated permissions can be chained to reach a critical asset such as a domain controller, cloud control plane, or sensitive database. The map usually starts from exposed identities and follows privilege escalation, lateral movement, inherited access, and secret reuse to show which path gives an attacker control.
Q: Why do tiered identity models fail in hybrid environments?
A: Tiered identity models fail in hybrid environments because the same human and machine identities often span on-premises directories, cloud tenants, SaaS tools, and automation platforms, where trust is inherited in different ways. A rigid tier boundary can hide shared credentials, synced accounts, federated sign-in paths, and service account privileges that cross the tiers.
Q: How does attack path management reduce identity risk?
A: Attack path management reduces identity risk by continuously identifying and prioritising the shortest routes from a compromised identity to high-value assets. It combines graph analysis, entitlement review, privilege exposure, and remediation actions such as removing standing admin rights, tightening role assignments, rotating secrets, and closing trust links that enable escalation.
Q: What should security teams protect beyond Tier 0?
A: Security teams should protect everything that can inherit or concentrate privilege beyond Tier 0, including admin workstations, directory sync accounts, federated identity providers, cloud control planes, backup systems, CI/CD pipelines, and service accounts. Those assets often become alternate routes to the crown jewels even when Tier 0 credentials themselves are tightly guarded.
Technical breakdown
Why tiered identity models miss real attack paths
Tiering is useful when the environment has clean privilege boundaries, but real enterprises are connected by delegation, trust and inherited access. Attackers do not need to break the directory model if they can move through valid relationships that were never intended to be security boundaries. The practical problem is not simply who has rights, but how rights compose across systems and trusts. Once those compositions are visible, the gap between policy design and actual reachability becomes measurable rather than assumed. See the Tiered Administration and Enterprise Access Model Guide.
Practical implication: Map real access chains, not just roles, before you assume a tier boundary is defensible.
How attack path management exposes choke points
Attack path management is the practice of identifying the shortest or highest-value routes from accessible identities to sensitive assets. It focuses on choke points, which are relationships or permissions whose removal breaks many downstream paths at once. In this model, a single mis-scoped trust edge or inherited privilege can matter more than dozens of low-impact accounts. The value is not just visibility. It is prioritisation, because the control work can be ordered by how much reachability each change removes. See the BloodHound and Active Directory Attack Path Guide.
Practical implication: Use choke-point analysis to prioritise remediations that collapse the most paths with the least operational disruption.
Why backup and recovery infrastructure needs identity scrutiny
Backup and recovery systems are often treated as operational tools rather than privileged identity targets, but they usually sit on sensitive trust paths. If an attacker reaches them through legitimate access, they can interfere with restoration, hide ransomware impact, or destroy recovery options. That makes them part of the identity plane, not just the resilience plane. The security question is whether these systems are isolated enough that ordinary access paths cannot reach them, especially through service accounts, delegated admin or shared trust relationships. See the Identity Visibility, Posture and Threat Detection Guide.
Practical implication: Treat recovery infrastructure as a privileged identity domain and test whether ordinary access can still reach it.
Threat narrative
Attacker objective: The attacker wants to reach high-value assets through legitimate identity paths while avoiding the noise and friction of direct compromise.
- Entry occurs through legitimate credentials or trusted relationships rather than obvious exploitation, which makes the initial path look normal to defenders.
- Privilege use expands as the actor follows connected systems and inherited relationships instead of attacking a single Tier 0 boundary.
- Impact lands when the route reaches critical assets such as backup, recovery or regulated-data systems, creating operational or data-loss exposure.
Breaches seen in the wild
- Moltbook AI agent keys breach: Moltbook breach exposed 1.5M AI agent keys.
- LiteLLM PyPI package breach: LiteLLM PyPI supply chain attack, credentials stolen from users.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Tier zero is a useful concept, but it is not a complete security model. Modern environments are held together by delegated rights, trusted relationships and inherited access that cut across neat directory tiers. That means the real question is not whether Tier 0 is protected in isolation, but whether the surrounding relationship graph still reaches the assets that matter. Practitioners should evaluate identity security as reachable-path control, not directory symbolism.
Attack path management turns invisible identity relationships into a governable surface. The discipline matters because the highest-risk edge is often not the account with the most privilege, but the path that connects an ordinary identity to a critical system. Once those paths are mapped, security teams can focus on choke points that collapse multiple routes at once. That is a better operating model than broad access reviews that miss how privileges compose in practice.
Backup and recovery systems are identity targets as much as they are resilience assets. If trusted access can reach them, an attacker can undermine recovery without needing to own the entire directory. That is why identity visibility and attack path management has to include recovery pathways, not just production admin lanes. The implication is straightforward: resilience planning and identity governance now have to be designed together.
Standing trust is the real weakness in many hybrid identity estates. The problem is not only excess privilege, but persistent relationships that remain valid long after the operational reason for them has faded. When those relationships are left in place, attackers can move through the estate with ordinary-looking credentials and still reach critical assets. Practitioners should treat stale trust edges as first-class exposure, not background noise.
Identity risk has shifted from control ownership to path ownership. Teams can no longer assume that hardening one privileged zone meaningfully reduces exposure if alternative paths still reach the same asset. The useful metric is not how many accounts are Tier 0, but how many live paths still connect non-critical identities to critical systems. Security programmes should therefore be judged by path reduction, not by directory labels alone.
From our research library:
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- Read next: Identity Visibility, Posture and Threat Detection Guide
What this signals
Identity programmes that still define risk by directory tier are likely missing the routes that matter most. The practical shift is toward reachability analysis, because attackers can use valid access to move through connected systems without ever breaking the core directory model.
Path ownership: The real governance unit is no longer the account or role alone, but the live route from an identity to a critical asset. Once organisations start measuring which edges create those routes, they can prioritise the control changes that remove the most exposure first.
Recovery and backup infrastructure should now be treated as part of the identity plane. If a trust path can reach restoration capability, resilience is conditional rather than assured, which means identity review and recovery design have to be planned together.
For practitioners
- Map identity relationships to critical assets Continuously enumerate how ordinary users, service accounts and delegated admins can reach backup, recovery and regulated systems through valid trust paths.
- Prioritise choke points over account counts Rank remediation by the number of attack paths each relationship removal collapses, not by how many individual accounts appear risky. See the BloodHound and Active Directory Attack Path Guide.
- Validate security boundaries in hybrid estates Test whether the boundaries you rely on still hold when access is inherited across directory trusts, cloud privileges and operational tooling.
- Include recovery infrastructure in identity reviews Review backup and restoration systems as privileged targets, including the identities and relationships that can change or destroy restore capability.
Key takeaways
- Identity risk in modern estates comes from reachable paths to critical assets, not just from whether Tier 0 is protected.
- Attack path management helps teams identify the trust edges that create the most dangerous routes through hybrid environments.
- Backup and recovery systems need identity governance because legitimate access paths can undermine restoration without touching the directory core.
Related NHI Mgmt Group resources: Identity Visibility, Posture and Threat Detection Guide · BloodHound and Active Directory Attack Path Guide · Tiered Administration and Enterprise Access Model Guide
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | TA0006; TA0008 — Credential Access; Lateral Movement | The video describes attackers moving through valid credentials and relationships toward critical assets. |
| Recommendation — Map attack paths to credential access and lateral movement patterns, then remove the relationships that enable them. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The core issue is entitlement reachability across trusted relationships and hybrid boundaries. |
| ID.AM-01 — Physical devices and systems are inventoried | Attack path management depends on knowing the systems and relationships that make paths possible. | |
| Recommendation — Review entitlements and trust edges against actual reachability to critical systems, not just against nominal role design. Maintain an inventory that includes the systems and identity relationships needed to trace critical attack paths. | ||
| CIS Controls v8 | CIS-5 — Account Management | Persistent accounts and delegated access often form the path edges attackers exploit. |
| Recommendation — Govern account lifecycles so stale or unnecessary access edges cannot keep critical paths open. | ||
Key terms
- Attack Path Management: Attack Path Management is the practice of finding and reducing the routes an attacker could use to move from an initial foothold to valuable assets. It maps identities, permissions, exposures, and trust relationships across systems, then prioritizes fixes that break lateral movement, privilege escalation, and access to crown-jewel data or services.
- Tier Zero Model: A tier zero model isolates the most sensitive administrative functions into a tightly controlled trust zone. In Active Directory, it limits who can administer domain controllers and related control-plane assets. The purpose is to prevent lower-trust systems or operators from reaching the highest-value identity infrastructure.
- Choke Point: A choke point is a control location where multiple attack paths converge and can be disrupted efficiently. It is a practical prioritisation concept, because closing one well-chosen control can remove several viable routes to critical assets at once.
- Trust Relationship: A configured connection in which one identity, system, or vendor is allowed to rely on another without repeating full verification every time. Trust relationships are efficient, but they become risky when they outlive the business need or grant broader access than the original purpose justified.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on November 4, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org