How can security teams detect acquired access?

What acquired access looks like in practice

Acquired access is not just “someone logged in.” It is the point where an attacker can use valid access material, such as a password, session token, API key, certificate, or refresh token, and blend into normal traffic. That is why detection focuses on abnormal use of legitimate access, not only on failed logins or blocked attempts.

The clearest indicators are behavioural shifts around an otherwise valid identity. A sign-in from a new device, an unfamiliar geography, atypical working hours, or a sudden change in the systems a user reaches can all show that the access path has changed hands. Strong detection also looks for privilege use that does not match the account’s normal role, because stolen access often becomes visible only when it is used to escalate or move laterally.

For defenders, this is closely related to broader adversary tradecraft. Techniques such as credential access, token abuse, privilege escalation, and lateral movement often sit behind what initially appears to be an ordinary authenticated session. MITRE ATT&CK Enterprise Matrix is useful for structuring detections around those post-compromise behaviours rather than treating every login as trustworthy.

Signals that separate normal use from stolen access

Detection improves when teams combine identity telemetry, endpoint context, and session history. Impossible travel is useful, but it should not be treated as a standalone verdict. It becomes more convincing when paired with unusual MFA prompts, fresh device registration, atypical user-agent strings, unfamiliar IP ranges, or access to high-value systems that the account rarely touches.

MFA fatigue patterns deserve special attention because they often indicate active pressure on the user, not just a misconfigured authentication flow. Repeated push approvals, bursts of rejected prompts, or a successful sign-in immediately after a long series of denials can show that the attacker is still trying to turn a partially compromised identity into durable access. Sensitive-system access outside normal patterns is another strong signal, especially when it occurs after a credential reset or password change that should have broken the attacker’s session.

Authentication trail review matters because many incidents leave traces in the sequence, even when the final login looks valid. Watch for token refreshes from a new location, session reuse after password reset, changes in trust device state, and access that starts at a low-risk application before touching admin consoles or data stores. If the attacker has obtained a reusable secret, the first abnormal action is often not the login itself but the first privileged operation.

Why fast containment matters when valid access is exposed

Once access material is in play, delay expands blast radius. A valid token or key can let an attacker bypass repeated prompts, continue across sessions, or reach systems that trust the original authentication event. The operational question is therefore not only “was access acquired?” but “what else can this credential still reach right now?”

That is why response should prioritise revocation and scope review over lengthy confirmation cycles. If the access material can still authenticate, assume it can still be used until proven otherwise. Teams should also check for persistence mechanisms, such as additional tokens, alternate recovery methods, delegated access, or secondary accounts created during the same compromise window. For API-driven environments, RFC 8707: Resource Indicators for OAuth 2.0 is relevant because audience-restricted tokens reduce how far a stolen token can be replayed.

Risk and Threat Considerations

Acquired access is risky because it converts a one-time compromise into repeated, legitimate-looking activity. The main danger is not the initial theft of a secret, but the attacker’s ability to keep using it until revocation, especially when tokens, sessions, or certificates remain valid across multiple systems.

Failure mechanism: Stolen credentials or tokens are reused from a new context, and the attacker pivots through trusted authentication paths, privilege abuse, or session persistence before defenders notice the anomaly.

Impact: The result can be data exposure, privilege escalation, lateral movement, account takeover, and delayed detection, especially when the access material has broad reach or long lifetime.

Practitioner Guidance

What to verify: Correlate sign-in events with device, network, and privilege telemetry before deciding whether the access is truly anomalous. A single impossible-travel event is weaker than a pattern that includes unusual role use, fresh token issuance, and sensitive-system access.

Decision rule: If the exposed material can still authenticate, treat it as active compromise and revoke it first, then investigate whether it was used for persistence or escalation. If the account is high privilege, assume the blast radius is wider than the first alert suggests.

Practitioner takeaway: Detecting acquired access is about proving that valid access is being used in an invalid way, then cutting off the reusable path before the attacker can turn one stolen secret into sustained control.

Related resources from NHI Mgmt Group

• Guide: MITRE ATT&CK Guide for Defenders
• Why are NHIs a critical concern for security teams?
• What steps should security teams take to prevent Shadow AI risks?
• Why is the abuse of NHIs a priority for security teams?
• What is the difference between SAST and DAST for security teams?