Identity data and human risk management are converging

At a glance

What this is: This is an analysis of how identity and access data improve human risk management by exposing privilege creep, MFA fatigue, and provisioning errors that behavior-only programmes miss.

Why it matters: It matters because IAM, HRM, and security teams need a shared view of user risk that combines access state with behaviour, not separate dashboards that miss exposure.

By the numbers:

• Organizations that use predictive human risk management achieve a 50% reduction in risky users and a 98% decrease in data-loss exposure.
• The Living Security platform correlates 200+ risk indicators across behavior, identity and access, and threat.
• Living Security states that its platform integrates with 60+ security tools, including major IAM platforms.

👉 Read Living Security Human Risk Management Platform's analysis of identity and human risk correlation

Context

Human risk management fails when it treats behaviour as the whole story. Identity, access, and behaviour are separate signals, but the risk picture only becomes operational when they are correlated, because a low-risk user with excessive privileges can be far more dangerous than a high-risk user with minimal access.

In IAM terms, the gap is not visibility alone. It is the inability of many programmes to connect privilege creep, MFA fatigue, and provisioning errors to the actual access state of the person involved, which leaves risk scoring disconnected from control decisions.

Key questions

Q: How should security teams combine identity data with behavioural risk scoring?

A: Start by linking user entitlements, access changes, and authentication events to behaviour telemetry in the same risk model. That lets teams distinguish a noisy but low-impact user from a low-noise user with excessive privileges. The goal is not more data, but better prioritisation that reflects actual blast radius.

Q: Why does privilege creep make human risk programmes less accurate?

A: Privilege creep changes the impact of a user's behaviour even when the behaviour itself stays the same. A user who moves roles but keeps old access can become a far higher-risk profile than the security team realises. Accurate risk scoring must therefore include entitlement drift, not just conduct.

Q: How can organisations tell whether MFA fatigue is becoming a control problem?

A: Look for repeated push prompts, approval rates that rise after multiple challenges, and privileged users receiving the same friction as low-risk users. Those signals show the authentication experience is conditioning unsafe behaviour. The control is failing when volume, not context, drives approval.

Q: Who is accountable when identity data is not synchronised?

A: Accountability sits with the team that owns identity governance, because synchronisation is a control outcome, not an optional convenience. If identity data is inconsistent across directories, no downstream application can reliably know which record to trust. That makes identity governance accountable for the failure, even if the symptom appears in authentication.

Technical breakdown

Why identity and behaviour signals must be correlated

Identity data shows what a user can reach, while behavioural data shows how that user is acting. Human risk programmes that use only one of those views create blind spots. Correlation is what turns scattered indicators into an actionable risk model, because the same behaviour means something different when paired with privileged access. A user who repeatedly accepts MFA prompts is not just a training problem if they also have broad administrative rights. That is why cross-domain scoring matters more than isolated alerts.

Practical implication: combine IAM entitlements, access changes, and behavioural telemetry in one risk model before deciding on interventions.

How privilege creep and provisioning errors distort human risk

Privilege creep occurs when access survives role changes, and provisioning errors occur when access is granted too broadly or removed too slowly. Both create risk that behavioural training will never see. The technical issue is lifecycle drift: identity records and entitlements stop matching job function and exposure grows quietly over time. When access outlives the role, the security team is measuring conduct without accounting for blast radius. That mismatch is where human risk programmes mis-rank priorities.

Practical implication: make joiner, mover, and leaver controls part of human risk scoring so stale access changes the risk calculation immediately.

Why MFA fatigue is an identity problem, not only a user problem

MFA fatigue is often described as user exhaustion, but the control failure starts with excessive authentication prompts and weak context around sign-in risk. Repeated prompts train users into unsafe approval behaviour, especially when the access request pattern is noisy or poorly targeted. The risk becomes more severe when those approvals can open high-value systems. In other words, the authentication experience itself can become a security exposure if it is not tuned to the user's access profile and threat context.

Practical implication: reduce repetitive prompts for low-value events and tie escalation logic to privileged access and suspicious sign-in conditions.

Threat narrative

Attacker objective: The objective is to turn weak identity governance and user fatigue into a pathway for broader internal access and data exposure.

1. Entry begins when an attacker leverages an over-permissioned account, a repeated MFA prompt, or a provisioning mistake to obtain access.
2. Escalation follows when excessive entitlements or stale access let the attacker move from a single user account into broader internal systems.
3. Impact occurs when that access is used to reach sensitive data, alter controls, or widen the attack surface before the mismatch is detected.

Breaches seen in the wild

• Cisco DevHub NHI breach — IntelBroker exploited exposed Cisco credentials, API tokens and keys in DevHub.
• Coupang Signing Key Breach — Unrevoked signing key credentials expose 33.7 million records after employee offboarding failure at Coupang.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity risk cannot be measured correctly without access context. Behavioural signals alone describe intent or reaction, but they do not describe blast radius. When access state is omitted, a low-risk behavioural profile can mask a high-impact identity. Practitioners should treat identity and behaviour as a single risk equation, not parallel programmes.

Identity-behaviour correlation is the named control gap this article exposes. The article's central point is that human risk becomes visible only when access data and behavioural data are analysed together. That is not a reporting convenience, it is a governance requirement for deciding who needs intervention first. The implication is that human risk management without IAM context is structurally incomplete.

Privilege creep is a lifecycle failure, not an awareness failure. Users do not become riskier only because their behaviour changes. They become riskier when access outlives role changes and no one re-baselines the entitlement set. That means access reviews and mover controls sit at the centre of human risk governance, where the organisation actually changes exposure.

MFA fatigue shows how authentication volume can become a risk signal. Repeated prompts are not neutral friction when they condition users into approving requests they would otherwise reject. The governance lesson is that authentication telemetry belongs in human risk scoring alongside access and behavioural data, because repetitive challenge patterns can indicate both weak control design and active attack pressure.

Targeted intervention only works when the risk model is operationally precise. Cross-domain scoring should lead to specific actions such as access review, escalation, or micro-learning, depending on the combination of indicators. That is the practical difference between a risk dashboard and a risk programme.

From our research:

• 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, according to The 2024 ESG Report: Managing Non-Human Identities.
• Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, according to The State of Non-Human Identity Security.
• That confidence gap is a signal to move from awareness-only programmes to correlated identity, access, and threat controls across both people and machines.

What this signals

Identity and behaviour correlation is becoming the baseline for credible human risk management. Programmes that stop at awareness metrics will continue to mis-rank exposure, because the same behavioural pattern means very different things when access is broad. The next stage is to make entitlement drift and authentication friction first-class risk inputs, with review cadence tied to role changes and privileged access. See the NHI Lifecycle Management Guide for the lifecycle discipline that mirrors this pattern in non-human access.

Human risk programmes are starting to converge with identity governance. Once that happens, the operational question is not whether to collect more signals, but which signals materially change intervention decisions. That is where access state, privileged actions, and authentication patterns matter more than standalone training completion. For broader control alignment, the NIST Cybersecurity Framework 2.0 remains a useful governance anchor.

Identity-behaviour correlation will also shape machine and agent governance. The same logic that exposes hidden human risk will be applied to service accounts and AI agents as their access becomes more dynamic and harder to review manually. That makes lifecycle control and trust boundaries central to both human IAM and NHI governance, not separate disciplines.

For practitioners

• Correlate IAM data with behavioural risk signals Build a single scoring model that combines entitlement breadth, recent access changes, MFA events, and behavioural indicators so security teams can see true exposure rather than isolated alerts.
• Treat privilege creep as a measurable risk driver Include mover and leaver entitlements in risk review cycles, and escalate any account whose access no longer matches current role, department, or system ownership.
• Tune MFA controls to reduce fatigue-driven approval risk Review repeated push patterns, throttle noisy prompts, and increase challenge strength when privileged access or anomalous sign-in context is present.
• Tie interventions to the specific risk combination Use automated nudges for low-to-moderate exposure, but route high-privilege and high-behavioural-risk cases to security investigation and access review before the next access cycle.

Key takeaways

• Behaviour-only human risk programmes miss the access context that determines real blast radius.
• Privilege creep, MFA fatigue, and provisioning errors are identity failures that change risk more than training does.
• The practical response is to correlate IAM data with behavioural signals and tie interventions to entitlement drift.

Key terms

• Human Risk Management: The practice of managing how people interact with security controls, especially under pressure, distraction, or deception. It combines training, policy, and friction management so identity systems are still usable enough that users do not bypass them in day-to-day work.
• Privilege Creep: Privilege creep is the gradual accumulation of access rights beyond what an identity actually needs. It usually happens when permissions are added for convenience and never removed. For NHIs, privilege creep expands blast radius and makes old credentials far more dangerous than their original purpose suggests.
• MFA Fatigue: MFA fatigue is the behavioural pressure created when repeated login prompts make a person more likely to approve access without checking carefully. It is a control failure in the authentication experience, and it becomes dangerous when the approved session carries broad privilege or long-lived access.
• Identity-behaviour convergence: The point where communication security and identity security operate as one problem because the attacker can abuse legitimate-looking behaviour to reach trusted systems. It matters when email, sign-in, and application telemetry must be interpreted together to understand risk.

What's in the full article

Living Security Human Risk Management Platform's full article covers the operational detail this post intentionally leaves for the source:

• How the 200+ risk indicators are grouped across identity, behaviour, and threat signals for scoring.
• The HRMCon 2025 session context and the Labcorp examples behind the correlation approach.
• How automated interventions are selected for different risk combinations in a live programme.
• The compliance and audit angle for demonstrating access effectiveness in regulated environments.

👉 The full Living Security Human Risk Management Platform article covers the Labcorp session, correlation model, and operational response patterns.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an identity security programme, it is worth exploring.