Insider risk is an access governance problem, not just behavior

At a glance

What this is: This is an analysis of why insider risk emerges from access drift, weak context, and unmanaged effective permissions across people and non-human identities.

Why it matters: It matters because IAM, IGA, PAM, and NHI teams all have to govern the same access sprawl problem, and audit-ready least privilege depends on precise entitlement context.

By the numbers:

• 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job.
• Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security.
• Lack of credential rotation is cited as the top cause of NHI-related attacks by 45% of organisations.

👉 Read Veza's analysis of insider risk, effective permissions, and least privilege

Context

Insider risk becomes dangerous when effective permissions outlive the business need that created them. In practice, that means role changes, project endings, contractor offboarding, and inherited cloud entitlements accumulate until access no longer reflects the real job being done, which is a classic IAM and NHI governance failure.

Veza’s article frames the problem through effective permissions, access graphs, and least privilege enforcement across both people and non-human identities. The key issue is not whether access exists in a directory, but whether the identity can actually reach sensitive data, perform high-risk actions, and still be justified under review.

That distinction matters for identity programmes because certification, offboarding, and privileged access controls often rely on incomplete context. When identity, data sensitivity, activity, and ownership are split across tools, teams end up rubber-stamping access rather than governing it.

Key questions

Q: How should security teams reduce insider threat risk through access governance?

A: Start with least privilege, then keep proving it through recurring access reviews and automatic revocation when roles change. Insider risk drops when users only retain the permissions needed for their current work, and when excess access is removed before it can be abused. Monitoring helps, but governance must shrink the available blast radius first.

Q: Why does privilege creep increase breach impact?

A: Privilege creep enlarges the blast radius of a compromised identity. If an attacker takes over an account that retained unnecessary rights, they can move farther, reach more systems, and extract more data before detection. Excess access turns a single credential problem into a broader containment problem.

Q: What do security teams get wrong about access reviews?

A: Teams often treat access reviews as proof of control, when they are really only a point-in-time check. If reviewers cannot see current activity and business context, they may approve access that is technically valid but operationally obsolete. The better test is whether the governance model can explain why access still exists.

Q: Who should own non-human identity governance when service accounts and tokens drift?

A: Ownership should sit with the application or platform team that can explain the business purpose of the credential and act on revocation. Security can set standards and monitor drift, but lifecycle decisions need an accountable owner who can prove why the access still exists and when it should be removed.

Technical breakdown

Effective permissions versus assigned roles

Assigned roles describe what an identity should be allowed to do in theory. Effective permissions show what it can actually do after policies, inheritance, group membership, app-level grants, and cloud entitlements are combined. That distinction matters because insider risk usually appears in the gap between intended and effective access. A user may have no visible high-risk role but still retain write access to finance data through nested permissions or inherited policy layers. For NHI programmes, the same issue appears when service accounts or tokens accumulate broad object-level reach that no one has revalidated.

Practical implication: build review and revocation decisions on effective permissions, not on the role name alone.

Why access reviews fail without context

Access reviews break down when approvers cannot see owner, data sensitivity, last use, downstream reach, and business purpose in one place. Without that context, managers default to approval bias because revoking access feels riskier than retaining it. This is why certifications often become a ritual instead of a governance control. For human and non-human identities alike, the review process needs evidence that links access to an actual operational need, otherwise stale entitlements survive every cycle.

Practical implication: attach usage, ownership, and sensitivity evidence to every review item before asking for certification.

Toxic combinations and identity blast radius

A toxic combination is a set of permissions that is individually plausible but collectively dangerous, such as create-vendor plus approve-payment or broad read-write access to production data. The real control problem is not just over-privilege. It is the blast radius created when separate entitlements intersect across applications, clouds, and data stores. Identity security platforms that correlate identities, roles, policies, objects, and activity expose that compound risk. The same principle applies to service accounts and workload identities, where a small scope drift can create a large operational and audit exposure.

Practical implication: map access paths across systems so compound privilege can be removed before it becomes an incident.

Threat narrative

Attacker objective: The objective is to keep high-impact access available long enough to manipulate data, approvals, or privileged systems without triggering timely revocation.

1. Entry begins with quiet privilege accumulation rather than a single obvious compromise, such as a contractor rollback, orphaned role, or service account that remains active after its original purpose ends.
2. Escalation occurs when inherited entitlements, app-level grants, or stale non-human credentials expand the identity's effective reach beyond what anyone intended to authorize.
3. Impact follows when that accumulated access enables finance changes, sensitive data exposure, toxic approval paths, or audit findings that reveal access outlived the business need.

Breaches seen in the wild

• Coupang Signing Key Breach — Unrevoked signing key credentials expose 33.7 million records after employee offboarding failure at Coupang.
• Cisco DevHub NHI breach — IntelBroker exploited exposed Cisco credentials, API tokens and keys in DevHub.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Access drift is the real insider-risk engine, not isolated bad behavior. The article is strongest when it treats privilege creep, offboarding gaps, and inherited cloud access as the underlying condition. That is the same pattern we see across IAM and NHI programmes: access accumulates faster than governance can justify it. Practitioners should treat drift as a control failure, not an exception.

Effective permissions create a more accurate governance unit than assigned roles. Assigned roles are too coarse to explain real exposure in hybrid environments, especially when app-level grants and inherited policies change the actual access path. The practical consequence is that certification quality depends on seeing what an identity can truly do, not what the directory says it should do. Teams that lack that view are governing fiction.

Non-human identities need the same lifecycle discipline as people, but with different evidence. Service accounts, tokens, and workload identities do not drift like employees do, yet they still outlive projects, vendors, and owners. The named concept here is effective-permission drift: the gap between an identity's formal assignment and its actual reach. That gap becomes the governance problem to close.

Toxic combinations are a governance category, not just a detection category. Many organisations only discover dangerous combinations after audit or incident review, which means they have already accepted a wider identity blast radius than intended. Access graphs change that by making cross-system privilege visible before the combination is exercised. Practitioners should use this as a design principle for least privilege programmes.

Least privilege must become evidence-based, not calendar-based. A scheduled review without usage, sensitivity, and downstream path data is little more than a compliance ritual. The article points to a stronger operating model where access decisions are anchored in real context and can be revoked surgically. That is the difference between governance and administration.

From our research:

• 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to The State of Non-Human Identity Security.
• Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, compared to nearly 1 in 4 for securing human identities, according to The State of Non-Human Identity Security.
• For a broader view of why lifecycle and access sprawl keep resurfacing, see Ultimate Guide to NHIs , Key Challenges and Risks.

What this signals

Effective-permission drift: the next governance problem is not whether an identity exists, but whether its reachable data and actions still match the business case. As cloud, SaaS, and NHI estates converge, teams need to evaluate access at the object and activity level, not just at provisioning time.

With 85% of organisations lacking full visibility into third-party OAuth connections according to The State of Non-Human Identity Security, the control gap is already structural. That visibility problem is exactly why access reviews and offboarding are failing in hybrid identity programmes.

For practitioners, the right response is to operationalise access governance as a continuous workflow tied to the Ultimate Guide to NHIs and to the revocation model in 52 NHI Breaches Analysis. The programme signal to watch is not how many reviews are completed, but how quickly high-risk entitlements are removed after context changes.

For practitioners

• Rebuild reviews around effective permissions Require reviewers to approve or revoke based on actual reachable objects, inherited policy, and app-level grants rather than on directory roles alone.
• Attach business context to every certification item Include owner, data sensitivity, last used date, and downstream reach in the review packet so approvers can make a defensible decision without guessing.
• Identify and remove toxic combinations first Prioritise access paths such as create-and-approve, write-and-exfiltrate, or broad data-store reach before cleaning lower-risk dormant access.
• Apply lifecycle controls to non-human identities Track service accounts, tokens, and workload identities with the same offboarding discipline used for people, including ownership changes, revocation triggers, and evidence retention.
• Use access graphs for revocation decisions Correlate identities, roles, policies, objects, and activity so revocation targets the specific entitlement creating risk instead of disabling broad access unnecessarily.

Key takeaways

• Insider risk in this article is fundamentally an access governance problem, because entitlement drift and thin context let privilege outlive its business purpose.
• Effective permissions, toxic combinations, and non-human identity lifecycle gaps are the practical failure points that turn routine access into breach-ready exposure.
• The control that matters most is evidence-based least privilege, where reviews, revocation, and offboarding are driven by actual reach rather than by directory labels.

Key terms

• Effective Permissions: Effective permissions are the access an identity can actually use after role inheritance, scope, and policy are applied. In Azure AI environments, they often matter more than the assigned role name because inherited rights can widen access to data, logs, and secret stores.
• Toxic Access Combination: A toxic access combination is a set of permissions that becomes dangerous when granted together, even if each entitlement looks acceptable on its own. In identity governance, these combinations matter because they can enable misuse, separation-of-duties failures, or broader compromise.
• Privilege Creep: Privilege creep is the gradual accumulation of access rights beyond what an identity actually needs. It usually happens when permissions are added for convenience and never removed. For NHIs, privilege creep expands blast radius and makes old credentials far more dangerous than their original purpose suggests.
• Access Graph: An access graph is a relationship model that links identities, permissions, data objects, and system interactions. In NHI governance, it helps security teams see the full path from an agent or user to the action it can take, which is more useful than isolated account reviews.

What's in the full article

Veza's full article covers the operational detail this post intentionally leaves for the source:

• Access Graph examples showing how identities, roles, policies, and objects are correlated in practice
• Workflow detail for certifications, scoped revocations, and audit evidence capture
• Specific scenarios for compromised employee accounts, vendor offboarding, and service account drift
• Implementation patterns for tying access decisions to downstream reach and data sensitivity

👉 The full Veza article covers access graphs, review workflows, and NHI lifecycle controls in more operational detail.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an identity security programme, it is worth exploring.