Topic starter
02/08/2026 12:06 pm
TL;DR: High-value targeting pushes pentesting to focus on the systems and accounts attackers value most, using business context to prioritise domain controllers, privileged users, and critical servers, according to Horizons.ai. That framing matters because identity and attack-path significance, not raw vulnerability count, now determines blast radius and response urgency.
Editorial analysis by NHI Mgmt Group, based on content published by Horizons.ai: “Introducing NodeZero® High-Value Targeting: Think Like an Attacker, Prioritize What Matters”.
Key questions
Q: What breaks when penetration testing does not prioritise high-value identities first?
A: Teams get a flat list of findings instead of a picture of which identities and systems would actually expand attacker reach.
Q: Why do privileged service accounts create outsized risk in identity environments?
A: Privileged service accounts can be used quietly by attackers to move across systems without triggering the same scrutiny applied to human users.
Q: How do security teams know if identity prioritisation is actually working?
A: They should see the highest-risk assets and identities consistently rising to the top of testing, recertification, and PAM reviews.
Practitioner guidance
- Map identity blast radius Rank privileged users, service accounts, and executive identities by the systems they can reach, not by their titles alone.
- Prioritise domain controllers and delegation hubs Treat domain controllers, directory-admin paths, and other authentication choke points as top-priority assets in testing and remediation.
- Correlate service account access with business processes Tie each service account to the financial, operational, or administrative workflow it controls so high-impact identities surface quickly.
Bottom line: High-value targeting reframes pentesting around the identities and systems that determine attacker leverage, not the total count of findings.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:10 pm
High-value targeting is an identity governance problem disguised as a testing problem: The article shows that compromise value comes from the role an identity plays in the business, not from its label in an asset register. Domain controllers, privileged service accounts, and executive mailboxes create very different blast radii even when they appear equally reachable. For practitioners, that means prioritisation has to be governed as an identity decision, not a scanner output.
A few things that frame the scale:
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to the Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What is the difference between a technically privileged account and a high-value identity?
A: A technically privileged account has elevated permissions, while a high-value identity is one whose compromise changes the attacker’s options in a meaningful business way. Some accounts with limited formal privilege can still be high value if they touch payments, executives, or essential operations.
👉 Read our full editorial: High-value targeting shows why attackers prioritize identity first