Identity-based lateral movement is the real breach accelerator

At a glance

What this is: This is an identity security analysis of how attackers traverse legitimate access paths to move laterally after initial compromise.

Why it matters: It matters because IAM, NHI, and human access programmes all shape the paths an attacker can reuse, not just the permissions users think they have.

By the numbers:

• When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases.

👉 Read Zluri's analysis of identity-based lateral movement and governance gaps

Context

Identity-based lateral movement is the problem of an attacker using real credentials and approved access paths to move from one part of an environment to another. In practice, the issue is not simply the first compromise, but the breadth of access that existing governance decisions already made available.

That matters for identity governance because privilege accumulation, orphaned accounts, shared service access, and SaaS integrations can turn ordinary access into an attack route. If the entitlement graph is dense, a low-value foothold can still lead to customer data, production systems, or cloud control paths.

The article argues that network security controls do not solve this on their own, because the traversal happens through identities and entitlements the organisation itself granted. For IAM and NHI teams, the real question is how much reachable access an attacker inherits from normal operations.

Key questions

Q: What breaks when identity governance leaves too many lateral movement paths open?

A: When identity governance leaves too many lateral movement paths open, a single compromised account can reach far more systems than its role should allow. The breach problem is not the first login, but the inherited reach created by stale permissions, shared credentials, and connected apps. Good governance limits what an attacker can traverse after compromise.

Q: Why do service accounts and shared credentials increase lateral movement risk?

A: Service accounts and shared credentials increase lateral movement risk because they often connect systems that users were never meant to bridge directly. If those credentials are broad, long-lived, or poorly reviewed, an attacker can reuse them to move across applications, cloud resources, and data stores with little friction. That is especially dangerous in SaaS-heavy environments.

Q: How do security teams know if access accumulation is becoming a breach path?

A: Access accumulation is becoming a breach path when users or service accounts hold permissions that exceed current job need, especially across multiple domains. The clearest signals are old project access, orphaned accounts, shared credentials, and OAuth grants that no one can explain. If those paths are still valid, they are still usable by an attacker.

Q: Who is accountable when lateral movement succeeds through approved access paths?

A: Accountability sits with the teams that own identity governance, access reviews, application ownership, and offboarding, because approved access paths are the control surface that enabled the traversal. Security tooling may detect the attack, but governance determines whether the path existed in the first place. That makes entitlement owners part of the breach-control chain.

Technical breakdown

What identity-based lateral movement actually uses

Identity-based lateral movement is the practice of moving through an environment using valid credentials, tokens, shared accounts, or approved integrations rather than exploiting code flaws. That makes it structurally different from traditional network traversal, because the access often looks normal to systems that only validate authentication. The attacker is mapping the entitlement graph, then following the paths that already exist between users, applications, cloud services, and data stores. The security failure is not that access exists at all, but that it is broader, older, and more connected than current need requires.

Practical implication: map and shrink the reachable identity graph before an attacker does.

How access accumulation turns into a movement highway

Access accumulation is what happens when role changes, project work, shared credentials, and SaaS adoption add permissions without removing the old ones. Over time, an ordinary user or service account can end up with cross-domain reach that was never intentionally designed as a single access profile. In that state, lateral movement is less about discovery of a vulnerability and more about discovery of a forgotten permission path. The account history becomes the attack surface, especially where offboarding, recertification, and integration review are weak.

Practical implication: review accumulated access as an attack-path problem, not just an audit task.

Why shadow SaaS and integrations hide the real route

Shadow SaaS, OAuth grants, and service-to-service integrations create identity links that are often outside the SSO catalog and outside normal monitoring. That means the attacker can traverse connected tools without tripping the controls that watch only the governed perimeter. In many environments, the dangerous path is not the one through core systems, but the one through the unmanaged application layer that binds those systems together. This is why lateral movement is increasingly an identity governance problem as much as a detection problem.

Practical implication: discover and govern connected apps, grants, and service credentials as one access fabric.

Threat narrative

Attacker objective: The attacker wants to inherit enough legitimate reach to reach sensitive systems without needing to break through additional security controls.

1. Entry occurs when an attacker compromises a low-value identity such as a phished user account, an orphaned account, or a service account with stale access.
2. Escalation happens by tracing legitimate entitlements, shared credentials, and integrations until the attacker reaches higher-value systems and cloud resources.
3. Impact follows when the attacker reaches customer data, production systems, or credentials that unlock broader compromise across the environment.

Breaches seen in the wild

• MongoBleed breach — MongoBleed exposed secrets across 87K MongoDB servers.
• IOS app secrets leakage report — iOS apps leaking hardcoded secrets and credentials endangering user privacy.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity-based lateral movement is a governance failure before it is an attack technique. The article makes the right point that the attacker often does not need to break controls, only to reuse the access paths governance already left open. That shifts the problem from detection to entitlement design, because every extra path broadens the blast radius available to a low-value foothold. The practical conclusion is that identity governance must be judged by how much unintended reach it allows.

Access accumulation is the named concept this article exposes. It describes the way ordinary provisioning decisions, role changes, and service-account shortcuts build a hidden attack map over time. That map is often denser than the one security teams think they manage, especially where SaaS sprawl and cross-domain access have outpaced recertification. Practitioners should treat accumulated access as latent movement infrastructure, not as harmless administrative residue.

Ungoverned SaaS and integration sprawl are identity issues, not separate application problems. The article shows that lateral movement frequently travels through connections that sit outside the core IAM perimeter. That means entitlement governance, shadow application discovery, and service credential oversight are part of the same control plane. The practitioner takeaway is that access governance must follow the connection graph, not just the login page.

Privilege review cadence matters less than privilege persistence. The article shows that attackers benefit most when access survives long after the original business need has passed. That is a direct challenge to programmes that treat annual review as sufficient evidence of control. The implication is that governance must measure how long excess access remains reachable, not just whether it was eventually reviewed.

Cross-domain access concentration creates the shortest route to breach impact. When one identity spans engineering, SaaS, cloud, and data systems, lateral movement no longer requires many hops. This is why separation of duties, offboarding, and access scoping should be assessed together. Practitioners should reduce the number of identities that can bridge multiple sensitive domains at once.

From our research:

• The average organisation believes more than 1 in 5 of their non-human identities are insufficiently secured, according to The 2024 ESG Report: Managing Non-Human Identities.
• 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, with 46% confirmed and 26% suspected.
• For a broader breach lens, 52 NHI Breaches Analysis shows how identity failures turn into repeatable attack paths across environments.

What this signals

Access accumulation is the hidden governance debt inside most identity programmes. The longer an organisation leaves role changes, shared accounts, and integration sprawl unreviewed, the more likely a compromised identity can move laterally without triggering an obvious anomaly. That is why entitlement graph visibility belongs in the same conversation as recertification and offboarding.

With more than 1 in 5 non-human identities considered insufficiently secured in our research, the security problem is not a lack of tooling but a mismatch between how access is granted and how attackers traverse it. Teams need to treat every persistent connection as a potential route, especially where SaaS and service accounts bridge systems that would otherwise be isolated.

For practitioners, the next step is to move from account-level visibility to path-level governance. The relevant control question is no longer only who has access, but which identities can reach which assets through which connected services, and whether the Lifecycle Processes for Managing NHIs are actually removing those paths on time.

For practitioners

• Reduce cross-domain reach in long-lived identities Identify users and service accounts that accumulate access across engineering, cloud, SaaS, and data domains, then remove permissions that no longer match current role or function. Focus first on accounts with shared credentials, inherited project access, and dormant privileges that survived role changes.
• Inventory shadow SaaS and connected integrations Discover applications, OAuth grants, and service-to-service links that sit outside the governed SSO catalog. Treat every unmanaged connection as a potential lateral movement route and require ownership, business justification, and periodic review.
• Shorten the life of stale access paths Replace annual review cycles with control points that trigger when roles change, projects end, vendors leave, or integrations are modified. Remove access as soon as the business need disappears, especially for shared service accounts and dormant external connections.
• Use entitlement graph visibility as a priority signal Build reports that show which identities can reach which systems and how many hops separate them from sensitive assets. Prioritise remediation where a single account bridges multiple high-value domains or where a low-privilege user can reach cloud credentials.

Key takeaways

• Identity-based lateral movement succeeds when governance leaves legitimate access paths broader than current need.
• The real scale issue is accumulated reach, not just the initial compromise, because old permissions and shared connections become attacker routes.
• Practitioners should focus on entitlement graph visibility, access removal, and cross-domain scope reduction to limit breach propagation.

Key terms

• Identity-based lateral movement: The use of valid identities, credentials, and approved access paths to move from one system or service to another after an initial foothold. It is dangerous because the activity can look normal to control systems that only validate authentication, while the attacker quietly expands reach across the environment.
• Access accumulation: The gradual buildup of permissions, shared access, and integrations across an identity’s lifecycle. In practice, it is the history of old roles, project access, and service connections that remain active after the business need changes, creating hidden routes an attacker can reuse.
• Entitlement graph: The connected map of who can reach what, directly and indirectly, through applications, cloud services, shared accounts, and integrations. For security teams, it is the operational picture that shows how far a compromised identity can travel before it hits a sensitive asset.
• Shadow SaaS: Software adopted outside formal IT or identity governance processes, often without full visibility in SSO or access review systems. Shadow SaaS matters because it creates access paths and data connections that attackers can traverse without generating the signals the governed environment is watching.

What's in the full article

Zluri's full article covers the operational detail this post intentionally leaves for the source:

• Step-by-step explanation of how attackers traverse legitimate identity paths after the first foothold.
• Specific examples of how role changes, SaaS sprawl, and shared credentials build movement pathways.
• Detailed reasoning on why behavioural detection misses identity-based traversal in shadow environments.
• Practical prevention ideas for reducing the access graph before an attacker can map it.

👉 Zluri's full post covers the attack path examples, access-graph logic, and prevention detail.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.