Who should be accountable when an insider misuses authorised access?

Why This Matters for Security Teams

When an insider misuses authorised access, the failure is rarely just the person who clicked, queried, or exported data. It is also a control failure: excessive access, weak segregation of duties, poor review cadence, missing monitoring, or unclear ownership. That is why accountability must be assigned before incidents, not argued after them. Current guidance from the OWASP Non-Human Identity Top 10 is consistent with NHIMG research showing that 97% of NHIs carry excessive privileges, which expands the blast radius when governance is weak.

For security teams, the practical question is not whether the actor had permission in the narrow technical sense. It is whether the organisation made that permission defensible through least privilege, review, logging, and timely revocation. If access was granted without a clear owner, or retained after role changes, the incident points to governance gaps across IAM, PAM, data owners, and managers. In practice, many security teams encounter accountability failures only after evidence preservation, legal review, and regulator questioning have already begun, rather than through intentional control testing.

How It Works in Practice

Accountability should be mapped to the people who designed, approved, operated, and oversaw the access model. The individual insider remains accountable for misconduct, but the organisation is accountable for whether the access was appropriate, monitored, and revoked in line with policy. That distinction matters because regulators typically evaluate control ownership, not just intent.

A workable approach usually includes four layers:

• Access approval: business owners and data owners justify the access and define the business need.
• Technical enforcement: IAM and PAM teams implement least privilege, session controls, and reviewable entitlements.
• Operational monitoring: security operations and detection teams watch for anomalous use, bulk export, privilege chaining, or off-hours activity.
• Governance and attestation: managers and control owners periodically re-certify that the access is still required.

NHIMG’s Ultimate Guide to NHIs is especially relevant here because it highlights how weak lifecycle governance creates persistent exposure. The same pattern applies to authorised insider misuse: access that is technically valid but no longer justified becomes a governance defect. The OWASP guidance is useful because it frames identity abuse as an authorisation and lifecycle problem, not only a credential theft problem.

In mature environments, accountability is documented in policy, reflected in system ownership records, and tested through access reviews, alert triage, and revocation workflows. Where this guidance breaks down is in organisations with shared admin accounts, unowned service access, or informal approvals in chat and email, because there is no reliable chain of responsibility to audit.

Common Variations and Edge Cases

Tighter access governance often increases operational overhead, so organisations must balance speed of work against the cost of stronger review and revocation controls. That tradeoff becomes more visible in engineering teams, shared platforms, and regulated environments where access changes frequently.

There is no universal standard for this yet, but current guidance suggests a few common edge cases:

• Shared credentials: accountability becomes difficult to assign because activity cannot be reliably attributed to one person.
• Emergency access: break-glass use may be authorised, but it still requires post-event review and documented justification.
• Third-party admins: vendor access often creates split accountability between the customer, the vendor, and the platform owner.
• Privileged automation: where service accounts or agents act with delegated rights, the organisation must treat governance failures as ownership failures, not just user misconduct.

For this reason, security leaders should avoid over-relying on disciplinary language alone. The more useful question is whether the access model made misuse predictable and preventable. NHIMG’s 52 NHI Breaches Analysis shows how recurring identity failures often stem from governance gaps rather than isolated bad actors. In practice, insider misuse becomes harder to defend when access reviews are stale, managers are rubber-stamping approvals, and no one can explain why the permission still existed.

Related resources from NHI Mgmt Group

• Who is accountable when an authorised fraud payment is not blocked?
• Who is accountable when excessive access leads to a breach or audit failure?
• Who is accountable when access is granted through policy-driven automation?
• Who is accountable when a SAML integration exposes privileged access?