Identity data and human risk management are converging

At a glance

What this is: This is a human risk management analysis showing that identity and access data materially change how organisations assess employee risk, especially where privilege creep, MFA fatigue and provisioning errors are present.

Why it matters: IAM and security teams need to treat human risk as an access problem as well as a behaviour problem, because the practical exposure often sits in entitlement scope and review gaps rather than awareness alone.

Context

Identity risk is not fully described by user behaviour alone. A person can complete training, avoid obvious phishing mistakes and still present high exposure if their access is excessive, outdated or poorly provisioned.

The article argues that human risk management becomes more accurate when identity and access data are correlated with behavioural signals. That puts IAM, access review and provisioning hygiene directly into the human risk conversation for security teams.

Labcorp's HRMCon 2025 experience is presented as an example of this convergence. The starting position is increasingly typical for organisations that have mature awareness programmes but fragmented identity and access visibility.

Key questions

Q: What breaks when workforce risk programmes ignore identity and access context?

A: They miss the difference between low-risk behaviour and high-risk behaviour with privileged access. Without identity context, a phishing failure or policy violation looks the same across the workforce, even though the consequence varies dramatically. That gap leads to generic interventions, weak prioritisation, and wasted effort. Security teams need access data to identify which risky behaviours could actually become material incidents.

Q: Why do over-provisioned accounts raise risk even when employees behave well?

A: Because the security issue is not only intent, it is reachable scope. If an employee has more access than their role requires, any compromise, mistake or MFA fatigue event has a larger blast radius, and the same behavioural pattern becomes more dangerous.

Q: What are the signs that privilege creep is distorting human risk scoring?

A: Users retain access after role moves, former department permissions stay active, and access reviews keep approving entitlements that no longer match current responsibilities. Those signals show that the risk model is reading old identity state instead of present operational reality.

Q: How should security teams reduce MFA fatigue risk without weakening access control?

A: Security teams should reduce MFA fatigue risk by adding number matching, device binding, prompt throttling, and clear reporting paths for suspicious requests. The goal is to make approval harder to coerce and easier to verify, while also limiting the access a single approved session can reach through least privilege and session controls.

Technical breakdown

Why behaviour-only human risk scoring misses actual exposure

Behavioural telemetry and identity telemetry answer different questions. Behaviour tells you whether a user is acting cautiously, while identity and access data tells you what damage that user could do if compromised, careless, or simply over-entitled. A low-click employee with domain admin access is not low risk in operational terms, and a noisy user with minimal entitlements is not the same problem. Human risk management becomes materially more useful when those signals are combined into one decision model instead of treated as separate dashboards.

Practical implication: correlate access scope with behavioural indicators before ranking user risk.

How privilege creep and provisioning errors expand the attack surface

Privilege creep occurs when access outlives role changes, and provisioning errors occur when access is granted too broadly or retained after termination. Both are identity governance failures that silently widen the attack surface even when no malicious behaviour is visible. The important technical point is that these are not just administrative mistakes. They change the boundary of what a compromised or careless user can reach, which means the risk signal comes from entitlement state, not from user intent alone.

Practical implication: treat entitlement drift and offboarding failures as risk inputs, not only as IAM housekeeping issues.

Why MFA fatigue is an identity problem as much as a behaviour problem

MFA fatigue is often described as user error, but the article correctly frames it as a control design issue tied to repeated authentication prompts. The pattern becomes dangerous when excessive push requests condition users to approve one without thinking, allowing an attacker to complete access. That means the security issue is not just bad judgement at the endpoint. It is also an identity and authentication workflow that creates predictable approval exhaustion under pressure.

Practical implication: review authentication prompt volume and approval patterns as part of risk scoring and control tuning.

Threat narrative

Attacker objective: The attacker aims to turn routine user access into broader internal reach by exploiting weak approval behaviour and excessive entitlements.

1. Entry begins when an attacker targets a user whose access posture already exceeds current job needs, because over-entitlement increases the value of any compromised account.
2. Credential or approval capture occurs when repeated MFA prompts wear down the user, increasing the chance that one authentication request is approved without proper scrutiny.
3. Impact follows when the resulting access is used against systems that the user should no longer reach, or should never have reached in the first place.

Breaches seen in the wild

• Uber breach 2022: A contractor's stolen password and MFA fatigue gave a Lapsus$-linked attacker Uber's internal tools; Uber rotated keys to many services.
• Microsoft Midnight Blizzard breach: Midnight Blizzard (APT29) exploited legacy test account without MFA to breach Microsoft.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity data has become a core input to human risk management, not a supporting signal. Behavioural scoring alone cannot explain the difference between a low-risk employee and a low-risk-looking employee with high-value access. The article reflects a broader shift in security programmes: access scope determines blast radius, so identity data must sit inside the risk model. Practitioners should stop treating HRM and IAM as adjacent functions and start treating them as one control plane.

Privilege creep is a human risk problem because it changes the security meaning of a person's behaviour. A user's actions look different once old entitlements linger after role changes, department moves or promotions. That means the same behavioural pattern can imply radically different exposure depending on current access state. Practitioners should use entitlement state to re-rank users, not simply to reconcile accounts.

MFA fatigue exposes a broken assumption in many human risk programmes: that authentication friction is always benign. The article shows that repeated prompts can become an attack enabler when approval exhaustion sets in. The implication is not just that MFA exists, but that prompt design and frequency now belong in human risk governance. Practitioners should treat authentication workflow quality as part of exposure management.

Provisioning accuracy now functions as a human risk control, not only an IAM hygiene metric. The article makes clear that over-provisioning at join time and delayed deprovisioning at leave time both distort risk scoring. That creates a named concept worth tracking: identity-driven human risk exposure, where access state is the dominant factor shaping operational risk. Practitioners should prioritise identity lifecycle quality as a measurable risk input.

What this signals

Identity-driven human risk exposure: once access state becomes part of human risk scoring, the programme stops measuring attitude in isolation and starts measuring actual blast radius. That changes the governance question from who clicked to who could have caused harm if compromised.

Labcorp's example shows why human risk programmes need entitlement data, not just training outcomes. When access anomalies, privilege drift and authentication fatigue sit in the same model, security teams can target interventions where the exposure is real rather than where the metrics are easiest to collect.

For practitioners

• Correlate access scope with behavioural scores Combine IAM entitlements, MFA events and behavioural telemetry into a single risk model so users are scored by both what they do and what they can reach.
• Review privilege creep by role change Run targeted recertification for employees whose access still reflects former departments, old projects or prior job functions.
• Tune MFA prompt volume and escalation paths Measure repeated push requests, approval rates and lockout patterns so fatigue becomes visible before it turns into account compromise.
• Fix joiner and leaver provisioning controls Verify that new users receive only role-required access and that departing users lose access before termination is complete.
• Escalate access anomalies even when behaviour looks normal Investigate sudden entitlement changes, unexpected privilege grants or dormant account reactivation even if the user's activity appears compliant.

Key takeaways

• Behaviour-only human risk programmes miss the access side of exposure and therefore understate the practical risk of many users.
• Privilege creep, MFA fatigue and provisioning errors are identity issues that can change exposure even when user behaviour appears acceptable.
• Security teams should connect IAM data to human risk scoring so interventions follow actual entitlement scope and not just awareness metrics.

Key terms

• Human Risk Management: The practice of managing how people interact with security controls, especially under pressure, distraction, or deception. It combines training, policy, and friction management so identity systems are still usable enough that users do not bypass them in day-to-day work.
• Privilege Creep: Privilege creep is the gradual accumulation of access rights beyond what an identity actually needs. It usually happens when permissions are added for convenience and never removed. For NHIs, privilege creep expands blast radius and makes old credentials far more dangerous than their original purpose suggests.
• MFA Fatigue: MFA fatigue is the behavioural pressure created when repeated login prompts make a person more likely to approve access without checking carefully. It is a control failure in the authentication experience, and it becomes dangerous when the approved session carries broad privilege or long-lived access.
• Provisioning Exception: A provisioning exception is any off-path access or device fulfillment step used to bypass the standard onboarding flow. Exceptions often solve immediate business pressure, but they also create governance debt, reduce auditability, and increase the chance of inconsistent access decisions.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.