High-value targeting shows why attackers prioritize identity first

At a glance

What this is: This is an analysis of high-value targeting in autonomous pentesting, showing that attackers and defenders should prioritize the systems and identities that create the largest business impact.

Why it matters: It matters because IAM, PAM, and NHI programmes have to focus on the accounts and pathways that expand blast radius, not just the ones with the most technical findings.

Context

High-value targeting is a prioritisation problem, not a vulnerability-count problem. In practice, the issue is that attackers do not treat every system equally, and most enterprise defence programmes still do.

For identity teams, the key gap is that business-critical accounts, service identities, and domain controllers create very different blast-radius profiles even when they look similar in inventory or scanner output. That makes attack-path context as important as asset discovery.

Horizons.ai frames this through autonomous pentesting, but the broader lesson is that identity governance has to understand which accounts, relationships, and systems would actually change an attacker’s options after initial access.

Key questions

Q: What breaks when penetration testing does not prioritise high-value identities first?

A: Teams get a flat list of findings instead of a picture of which identities and systems would actually expand attacker reach. That means remediation effort is spread across low-impact assets while the true blast-radius drivers, such as domain controllers and critical service accounts, remain under-weighted.

Q: Why do privileged service accounts create outsized risk in identity environments?

A: Privileged service accounts can be used quietly by attackers to move across systems without triggering the same scrutiny applied to human users. They often have broad access, weak password hygiene, and limited visibility. When these accounts are unmanaged, they increase blast radius, complicate detection, and make containment slower after compromise.

Q: How do security teams know if identity prioritisation is actually working?

A: They should see the highest-risk assets and identities consistently rising to the top of testing, recertification, and PAM reviews. If critical accounts only appear after broad scanning or after incidents, prioritisation is still too shallow to reflect real attack paths.

Q: What is the difference between a technically privileged account and a high-value identity?

A: A technically privileged account has elevated permissions, while a high-value identity is one whose compromise changes the attacker’s options in a meaningful business way. Some accounts with limited formal privilege can still be high value if they touch payments, executives, or essential operations.

Technical breakdown

How high-value targeting scores identity and asset criticality

High-value targeting combines fast classification with deeper contextual scoring. The first pass uses naming patterns, service indicators, and structural cues to identify likely domain controllers, database servers, administrative accounts, and other sensitive assets. A second pass then refines that ranking using network metadata, identity attributes, business context, and external signals so the system can distinguish a technically ordinary host from a business-critical one. The important shift is that prioritisation is not based on a single indicator. It is based on how multiple signals change the expected impact of compromise and the likely attack path that follows.

Practical implication: Practitioners should evaluate whether their discovery and prioritisation logic can rank assets by business impact, not just by technical exposure.

Why identity metadata changes attack-path value

Identity metadata makes the difference between a generic account and a high-value target. Group memberships, SPNs, delegated permissions, and account naming can reveal whether an identity is tied to finance, administration, or executive risk. In the article, a service account with no administrative privileges still scores as high value because it can move money and alter records. That is the core lesson: privilege is not only about elevated rights. It is also about what downstream business systems an identity can reach, influence, or authenticate into.

Practical implication: Practitioners should correlate group membership and delegated access with business process impact before deciding which identities require tighter governance.

Why autonomous attack prioritisation mirrors real adversaries

The article’s autonomous pentesting model matters because it replays how attackers adjust once they discover new systems, credentials, and relationships. That behaviour makes static testing incomplete: the risk is not only whether an asset is vulnerable, but whether it becomes more valuable once adjacent identities or infrastructure are exposed. In identity terms, the attack path is dynamic. Once a controller, service account, or executive mailbox is found, the value of the next step changes. That is why attack-path analysis is more informative than flat vulnerability lists for governance decisions.

Practical implication: Practitioners should use attack-path views to identify which identities and systems would meaningfully expand an intruder’s reach after first access.

Threat narrative

Attacker objective: The attacker wants the smallest number of high-value footholds that produce the largest business-wide impact and the broadest future access.

1. Entry occurs after an attacker or autonomous tester gains initial access and begins reconnaissance rather than blind scanning.
2. Credential and relationship discovery then exposes domain controllers, privileged service accounts, and critical servers that provide disproportionate leverage.
3. Escalation follows when those identities or systems are used to reach authentication infrastructure, financial systems, or other high-impact assets.
4. Impact is achieved through broad access, ransomware enablement, wire fraud, sabotage, espionage, or persistence for later use.

Breaches seen in the wild

• Dropbox Sign breach 2024: A compromised back-end service account gave attackers Dropbox Sign customer data, including API keys, OAuth tokens and MFA information.
• Kubeflow cryptomining attacks 2020: Exposed Kubeflow dashboards and a notebook's mounted Kubernetes service account let attackers run cryptominers on tens of ML clusters.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

High-value targeting is an identity governance problem disguised as a testing problem: The article shows that compromise value comes from the role an identity plays in the business, not from its label in an asset register. Domain controllers, privileged service accounts, and executive mailboxes create very different blast radii even when they appear equally reachable. For practitioners, that means prioritisation has to be governed as an identity decision, not a scanner output.

Business context is now part of access risk: A service account can be more dangerous than a visibly privileged admin account if it touches payment flows, ledger postings, or critical operations. That is why identity programmes that stop at role names or technical privilege counts miss the real exposure. The lesson for IAM and PAM teams is to govern access by operational consequence, not by account type alone.

Attack-path visibility is the only meaningful prioritisation layer: Static inventories cannot show how newly discovered credentials, hostnames, and directory relationships reshape an attacker’s next move. The article’s model demonstrates that adversaries pursue the path that maximises leverage, not the host with the longest vulnerability list. Practitioners should treat attack-path analysis as a governance input, because it reveals which identities turn a local compromise into enterprise reach.

Identity blast radius should become a named control concept: The useful concept here is the blast radius created when one identity or system unlocks many others. That concept links human accounts, service identities, and infrastructure into a single governance question: how much organizational reach does one compromise create? For security leaders, the practical conclusion is that prioritisation, recertification, and PAM scope should all be driven by blast radius rather than by abstract severity scores.

Autonomous execution changes how prioritisation scales: As the article describes, the testing system can re-rank targets as new relationships are discovered. That makes prioritisation continuous instead of episodic, which is exactly how attackers behave in real environments. Teams should read that as a warning that point-in-time identity reviews will always lag the operational reality of attack-path discovery.

From our research library:

• 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to the Ultimate Guide to NHIs.
• Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
• Read next: Service Account Security Guide

What this signals

Identity blast radius now belongs in prioritisation logic: Security teams should stop treating all reachable identities as equal. The article’s logic shows that the question is not whether an account is privileged on paper, but how much of the environment it can unlock after first access. That is the core governance shift for IAM, PAM, and NHI programmes.

High-value targeting exposes a control gap in many review processes: Access reviews often look at entitlement state, while attackers care about expansion potential. If a service account can reach financial systems or domain infrastructure, that account deserves more scrutiny than its role label suggests. The practical outcome is that review cadences should be informed by attack-path value, not only by recertification schedules.

For practitioners

• Map identity blast radius Rank privileged users, service accounts, and executive identities by the systems they can reach, not by their titles alone.
• Prioritise domain controllers and delegation hubs Treat domain controllers, directory-admin paths, and other authentication choke points as top-priority assets in testing and remediation.
• Correlate service account access with business processes Tie each service account to the financial, operational, or administrative workflow it controls so high-impact identities surface quickly.
• Use attack-path views in governance reviews Review which identities would unlock the widest lateral movement or business disruption if compromised, then adjust oversight accordingly.
• Separate technical privilege from business risk Score accounts that look ordinary in directory data but can reach payment, operations, or executive systems as high-value targets.

Key takeaways

• High-value targeting reframes pentesting around the identities and systems that determine attacker leverage, not the total count of findings.
• The article shows that business context can make a non-admin service account more consequential than a visibly privileged user account.
• Practitioners should anchor prioritisation, PAM scope, and review cadence to blast radius and attack paths, not to inventory size alone.

Key terms

• High-value targeting: A prioritisation method that ranks identities, systems, and services by the damage an attacker could cause if they were compromised. In practice, it combines technical signals with business context so defenders focus on the access paths that create the largest blast radius first.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
• Attack-path prioritization: Attack-path prioritization is the practice of ranking findings by whether they are actually reachable from an attacker’s likely path. It moves teams away from treating every vulnerability equally and toward fixing the issues that connect exposure, privilege, and sensitive data in a realistic compromise chain.
• Business context enrichment: The process of attaching operational meaning to technical alerts, such as critical supplier status, revenue impact, or process dependency. This helps teams distinguish harmless anomalies from events that matter to the organisation. Without it, SOCs can be fast but still make the wrong decision.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.