Topic starter
21/08/2026 4:46 pm
TL;DR: Unosecur's analysis of Unit 42 data finds identity weaknesses in nearly 90% of incidents and identity-based techniques in 65% of initial access cases. That means teams need to trace and remove hidden privilege paths before compromise turns legitimate access into impact.
Editorial analysis by NHI Mgmt Group, based on content published by Unosecur: “Identity system misconfigurations: How legitimate access turns into breach risk”.
By the numbers:
- Identity-based techniques accounted for 65% of initial access.
Key questions
Q: Why do misconfigured identities weaken cybersecurity posture so quickly?
A: Misconfigured identities weaken posture because they connect directly to privilege abuse, lateral movement and failed containment.
Q: What signals show that privilege creep is getting out of control?
A: Look for growing numbers of dormant accounts, repeated exceptions, orphaned entitlements, and no clear owner for business-critical access.
Q: What breaks when identity audits rely only on roles and groups?
A: They miss the actual authorization conditions that decide whether an identity can perform a sensitive action.
Practitioner guidance
- Measure effective access paths Build reviews around what each identity can ultimately reach across roles, trust policies, secrets, and workload assumptions.
- Expire temporary privilege by design Require every elevated grant to carry an expiry, owner, and removal trigger so incident access and project access cannot silently become standing access.
- Review role changes for leftover entitlements Check movers for access inherited from prior jobs, especially where cloud roles, group membership, and project permissions accumulate across teams.
Bottom line: Identity misconfigurations matter because they create effective access that exceeds the access model's intent, even when every individual grant looks legitimate.
Glossary terms: Effective Access, Privilege Creep, Trust Relationship, Standing Privilege
What's in the full article
Unosecur's full article covers the operational detail this post intentionally leaves for the source:
- Examples of assigned access versus effective access across users, service accounts, workloads, and OAuth applications
- The article's full explanation of why temporary privilege and role changes create lasting exposure
- The question set it uses to test whether an identity's access is still justified
- Additional commentary on Unosecur's identity discovery and visibility approach
👉 Read Unosecur's analysis of how identity misconfigurations turn access into breach risk →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
21/08/2026 5:06 pm
Effective access is the real control surface: Identity governance fails when teams measure assigned roles instead of reachable resources. The article's central lesson is that a valid permission set can still produce unintended breach paths once inheritance, trust, and temporary grants are combined. Practitioners should treat effective access as the security object that matters.
A few things that frame the scale:
- 73% of vaults are misconfigured, leading to unauthorised access and exposure of sensitive data, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should teams govern non-human identities as assurance becomes continuous?
A: Teams should apply the same visibility, ownership, and purpose checks to non-human identities that they use for human access, but at machine speed. Service accounts, tokens, and automation identities often outlive the business purpose that created them, so continuous governance should track when they are created, used, and retired.
👉 Read our full editorial: Identity misconfigurations widen effective access beyond intended roles
This post was modified 4 days ago by NHI Mgmt Group