Notifications
Clear all
Topic starter
02/08/2026 11:54 am
TL;DR: Resolving effective permissions across SaaS and IaaS is essential for accurate blast-radius estimates, access reviews, and alert triage because layered policies, explicit denies, and role chaining obscure what an identity can actually do, according to Exaforce. Static entitlements are no longer enough when privilege must be computed from the full policy graph.
NHIMG editorial — based on content published by Exaforce: What can this compromised user actually do? Why effective permissions are a cornerstone of accurate threat analysis
By the numbers:
- NHIs outnumber human identities by 25x to 50x in modern enterprises.
- Only 5.7% of organisations have full visibility into their service accounts.
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface.
Questions worth separating out
Q: How should security teams determine what a compromised identity can actually do?
A: They should compute effective permissions rather than relying on the role or group shown in the source system.
Q: Why do assigned roles create blind spots in cloud investigations?
A: Assigned roles often hide the final policy outcome.
Q: How do effective permissions improve identity governance decisions?
A: They make access reviews and admin classifications consistent across systems that use different permission models.
Practitioner guidance
- Resolve permissions before triage Require SOC analysts to use computed effective permissions when scoring identity alerts, so severity reflects what the identity can actually do across accounts, services, and policy layers.
- Map explicit denies into access reviews Include service control policies, resource policies, and other deny logic in every access review so reviewers do not sign off on access that is visible but not executable.
- Standardise admin definitions on effective reach Define an admin as any identity that can increase its own access or another identity's access, then tag those identities consistently across SaaS and cloud environments.
What's in the full article
Exaforce's full blog covers the operational detail this post intentionally leaves for the source:
- Step-by-step examples of how permission evaluation works across AWS, GitHub, Slack, and similar systems
- Screenshots of the effective permission graphs and admin tagging views used in the product
- The remediation workflow that points analysts to the specific policy, role, group, or permission set to change
- Examples of runtime usage signals joined to permission data for better risk scoring
👉 Read Exaforce's analysis of effective permissions in SaaS and cloud investigations →
Effective permissions in SaaS and IaaS: what SOC teams miss?
Explore further
02/08/2026 1:02 pm
Effective permissions are now the operational truth of identity security. Assigned access is increasingly an approximation, not an answer, because modern SaaS and IaaS environments combine multiple policy layers, inheritance paths, and explicit denies. That is why blast-radius analysis, access reviews, and SOC triage all fail when they rely on surface entitlements alone. Practitioners should treat resolved privilege as the control plane for risk decisions.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
A question worth separating out:
Q: What should teams do when an alert involves an identity with unclear privilege scope?
A: They should pause severity scoring until the permission graph is resolved. The first question is not whether the login was suspicious, but whether the identity can modify controls, reach sensitive resources, or chain into higher privilege. That determines whether the alert is informational, material, or urgent.
👉 Read our full editorial: Effective permissions are the missing layer in identity threat analysis
