Topic starter
06/11/2026 6:36 pm
TL;DR: Identity risk now extends beyond core directory tiering because attackers can use legitimate credentials and trusted relationships to reach backup, recovery, regulated data and other critical assets, according to SpecterOps. The practical shift is from protecting a directory boundary to continuously mapping relationships and choke points that create attack paths.
Editorial analysis by NHI Mgmt Group, based on content published by SpecterOps: “Beyond Tier Zero”.
Key questions
Q: How do teams map identity attack paths to critical assets?
A: Teams map identity attack paths by tracing how accounts, groups, trusts, tokens, and delegated permissions can be chained to reach a critical asset such as a domain controller, cloud control plane, or sensitive database.
Q: Why do tiered identity models fail in hybrid environments?
A: Tiered identity models fail in hybrid environments because the same human and machine identities often span on-premises directories, cloud tenants, SaaS tools, and automation platforms, where trust is inherited in different ways.
Q: How does attack path management reduce identity risk?
A: Attack path management reduces identity risk by continuously identifying and prioritising the shortest routes from a compromised identity to high-value assets.
Practitioner guidance
- Map identity relationships to critical assets Continuously enumerate how ordinary users, service accounts and delegated admins can reach backup, recovery and regulated systems through valid trust paths.
- Prioritise choke points over account counts Rank remediation by the number of attack paths each relationship removal collapses, not by how many individual accounts appear risky.
- Validate security boundaries in hybrid estates Test whether the boundaries you rely on still hold when access is inherited across directory trusts, cloud privileges and operational tooling.
Bottom line: Identity risk in modern estates comes from reachable paths to critical assets, not just from whether Tier 0 is protected.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:42 pm
Tier zero is a useful concept, but it is not a complete security model. Modern environments are held together by delegated rights, trusted relationships and inherited access that cut across neat directory tiers. That means the real question is not whether Tier 0 is protected in isolation, but whether the surrounding relationship graph still reaches the assets that matter. Practitioners should evaluate identity security as reachable-path control, not directory symbolism.
A few things that frame the scale:
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What should security teams protect beyond Tier 0?
A: Security teams should protect everything that can inherit or concentrate privilege beyond Tier 0, including admin workstations, directory sync accounts, federated identity providers, cloud control planes, backup systems, CI/CD pipelines, and service accounts. Those assets often become alternate routes to the crown jewels even when Tier 0 credentials themselves are tightly guarded.
👉 Read our full editorial: Beyond tier zero: attack path management for critical assets