Six degrees of identity security issues in enterprise breaches

At a glance

What this is: This is an analysis of how identity management failures repeatedly enabled major breaches, with the source arguing that access privilege and mismanagement were central to 75% of incidents it reviewed.

Why it matters: IAM, IGA, PAM, and NHI teams need to treat access revocation, MFA enforcement, and least privilege as breach containment controls, not administrative hygiene.

By the numbers:

• The global average cost of a data breach last year was $4.45 million.
• 75% of security incidents were caused by bad actors taking advantage of human errors tied to access privileges and identity mismanagement.

👉 Read Opal Security's analysis of identity failures behind major breaches

Context

Identity mismanagement is the gap between who should have access and who still can exercise it. In this article, Opal Security frames that gap as a recurring breach driver, not a niche governance problem, because revoked access, missing MFA, and excessive privilege all extend the attacker’s usable window.

The identity security issue is not limited to humans, but this article’s primary evidence is human IAM and lifecycle failure: former employees, contractors, administrators, and compromised staff accounts. The pattern matters to NHI practitioners as well because the same governance failures, especially revocation and privilege scope, also govern service accounts, tokens, and other non-human identities.

The article’s six incident examples show a consistent sequence: access remains active after the trust relationship changes, authentication is weak or absent, and lateral movement becomes possible once an attacker is inside. That is a governance failure in access lifecycle control, not just a technical exposure.

Key questions

Q: What breaks when access revocation is delayed after termination?

A: Delayed revocation leaves a former employee, contractor, or partner with a valid path into systems that should already be closed. That turns a business relationship change into an attacker entry point and gives the compromise more time to spread before anyone notices. Revocation has to be event-driven, not merely periodic, or access outlives accountability.

Q: Why do missing MFA and excessive privileges make breaches worse?

A: Missing MFA makes stolen or guessed credentials easier to use, while excessive privileges decide how far the attacker can move once inside. Together they turn a single identity failure into lateral movement, data access, and often production exposure. The real risk is not only entry, but the amount of trust the compromised identity already holds.

Q: How do you know whether privileged access governance is actually working?

A: Look for reduced standing assignments, shorter activation periods aligned to task duration, and access reviews that routinely remove unused eligibility. If users still hold broad roles long after projects end, the programme is active only on paper. Effective governance shrinks both access scope and access duration.

Q: When does just-in-time access make more sense than permanent admin rights?

A: JIT access makes the most sense when elevated rights are needed for specific tasks rather than continuous operation. It reduces standing exposure, limits the value of stolen credentials, and makes reviews easier. If your teams cannot justify persistent admin access, it is usually a sign the role is too broad.

Technical breakdown

Why revoked access keeps becoming an entry point

Revocation is the point where identity lifecycle and security posture meet. When an employee leaves, a contractor rolls off, or a vendor relationship ends, access should terminate immediately across every system that accepted that identity. If revocation is partial or delayed, the old credential becomes a valid entry path long after the trust relationship has expired. In breach terms, that is not a broken password problem, it is an offboarding failure that converts a business change into an attacker opportunity. User access reviews help, but they are not enough on their own because they are periodic, not event-driven.

Practical implication: tie offboarding to authoritative termination events and verify that revocation reaches all systems, not just the primary directory.

How missing MFA and standing privilege widen blast radius

MFA reduces the value of a stolen password, but it does not fix excessive access once an attacker has a foothold. The article’s examples show that weak authentication and elevated privileges together create the conditions for lateral movement: the attacker gets in, then moves sideways into more sensitive systems. Least privilege matters because it limits how far a compromised identity can travel. Just-in-time access goes further by making high-risk permissions temporary rather than always available, which reduces the duration of exploitable access.

Practical implication: enforce MFA and pair it with least privilege and JIT access so compromise does not automatically become enterprise-wide exposure.

Why privilege escalation monitoring has to be real time

Privilege escalation is often the moment a compromise turns operationally significant. In the CircleCI example, the attacker impersonated a compromised employee and escalated access to production systems, which is exactly where delayed approval processes and weak monitoring fail. If privilege changes are only reviewed after the fact, the identity control has already lost. Real-time oversight matters because the security question is not only who has access, but when that access changes and whether the change was expected. For production systems, that timing is the attack surface.

Practical implication: monitor privilege changes in real time and require approval paths that can block unexpected escalation before production access is granted.

Threat narrative

Attacker objective: The attacker objective is to turn a stale or over-privileged identity into broad access to sensitive systems and data.

1. Entry occurred through retained credentials, missing MFA, or compromised staff accounts that were still able to authenticate after the trust relationship had changed.
2. Escalation followed when the attacker operated with excessive privileges or impersonated a valid user, allowing movement beyond the initial account’s intended scope.
3. Impact came from lateral movement into production, email, or sensitive data systems, which expanded a single identity failure into a broader breach.

Breaches seen in the wild

• Scania insurance portal breach 2025: An attacker used an external user login, likely stolen by infostealer malware, to take insurance claim documents from a Scania portal.
• Millions of Misconfigured Git Servers Leaking Secrets: Nearly 5 million misconfigured Git servers expose sensitive secrets and credentials online.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity mismanagement is a breach containment failure, not an administrative inconvenience. The article’s central pattern is that attackers repeatedly exploit access that should have expired, been narrowed, or been challenged with stronger authentication. That means IAM, IGA, and PAM are not back-office controls; they are part of incident prevention and blast-radius reduction.

Lifecycle governance is the control plane that matters most when trust relationships change. Termination, contractor offboarding, and acquisition integration all create moments when access should be re-evaluated immediately. The article shows that waiting for a periodic review leaves a large exposure window, so governance has to move closer to the event that changes the relationship.

Standing privilege turns small authentication failures into enterprise movement. Once MFA is absent or bypassed, excessive access decides how far the attacker can go. Least privilege and JIT are therefore not separate hygiene tasks but the mechanism that limits the damage when one identity is compromised.

Human IAM lessons apply directly to NHI governance. The same failure pattern that leaves former employees active after departure also leaves service accounts, tokens, and integrations alive after their original purpose has ended. If a programme cannot reliably revoke human access, it will struggle even more with non-human identities that are less visible and more numerous.

Access review cadence is too slow for modern identity compromise. The article’s examples show that periodic checks are useful, but only if they are backed by continuous monitoring and event-triggered revocation. Practitioners should treat stale access, not only stolen credentials, as the underlying governance defect.

What this signals

Access lifecycle is now a primary breach control. Organisations that still treat joiner-mover-leaver processes as compliance admin are missing the point. When termination, offboarding, and privilege changes are late, every downstream control starts from an unsafe baseline.

Standing privilege creates identity blast radius. The article’s incident pattern is not that attackers always need sophisticated exploits, but that once they obtain a valid account, broad permissions let them move into more sensitive systems. That is why least privilege and JIT access belong in the same operating conversation.

Continuous monitoring has to sit beside recertification. Periodic access reviews catch drift, but they do not close the exposure window between reviews. Practitioners should assume that any identity control based only on a calendar will lag the pace of compromise.

For practitioners

• Enforce event-driven offboarding Connect HR, contractor, and vendor departure signals to automatic revocation across directories, SaaS, cloud roles, and privileged pathways so access ends when the trust relationship ends.
• Require MFA on every critical system Eliminate exceptions for acquired environments, legacy platforms, and production tools by making MFA mandatory wherever identity can reach sensitive data or administrative functions.
• Reduce standing privilege before incidents do Replace always-on elevated access with JIT grants for production, admin, and sensitive support workflows so compromise does not inherit broad access by default.
• Monitor privilege escalation in real time Alert on anomalous role changes, token creation, and admin grants, then require fast human approval or automatic containment when the change does not match expected workflow.
• Expand access reviews beyond periodic UARs Use scheduled recertification to catch drift, but do not rely on it alone. Pair it with continuous monitoring so expired or over-scoped access is found between review cycles.

Key takeaways

• Identity failures, not only perimeter failures, repeatedly created the conditions for the breaches discussed in the source article.
• The article ties its pattern to 75% of security incidents, with examples that show how revocation gaps, missing MFA, and broad privilege amplify impact.
• The strongest limiting controls are event-driven revocation, MFA everywhere it matters, least privilege, and just-in-time elevation.

Key terms

• Identity Lifecycle Governance: Identity lifecycle governance is the set of processes that create, change, review, rotate, and revoke access across human and non-human identities. It matters because access risk usually increases when lifecycle events are slow, incomplete, or disconnected from the systems that rely on them.
• Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.
• Just-in-Time Access Request: Just-in-Time Access Request is a pattern that grants access only when it is needed and only for the duration required. It reduces standing privilege by making access temporary, policy driven, and task scoped. This approach is especially useful for contractors, sensitive systems, and short-lived operational work.
• Access Recertification: Access recertification is the periodic review of user or account permissions to confirm that access is still justified. It is useful, but it is not enough on its own because it reacts after entitlements already exist, which is why lifecycle governance must reduce the volume of exceptions before review time.

What's in the full article

Opal Security's full article covers the incident-by-incident identity failure patterns this post intentionally leaves at the analysis level:

• Cash App, Change Healthcare, CircleCI, Deloitte, Microsoft, and Snowflake as separate identity failure case studies
• The specific role of revoked access, missing MFA, and over-privileged accounts in each incident
• How least privilege and JIT access change breach impact when identity compromise already exists
• The vendor's recommended security posture changes for teams trying to reduce identity-related breach exposure

👉 The full Opal Security article walks through the incident examples and the access-control lessons behind them.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.