Why do advanced persistent threats increase risk when identity and access controls are weak?

Why This Matters for Security Teams

Advanced persistent threats become more dangerous when identity and access controls are weak because the attacker’s first foothold is only the beginning. APT operators are not trying to win quickly; they are trying to turn one compromised account into durable, covert access across systems, cloud services, and data pipelines. That is why poor authentication, shared credentials, and broad privileges matter so much. Current guidance from the OWASP Non-Human Identity Top 10 and NHI Management Group’s Ultimate Guide to NHIs shows that weak governance around service accounts, API keys, and secrets creates the pathways APTs need to persist and blend in.

This is especially risky because modern enterprises now depend on thousands of machine identities, not just users. If those identities are overprivileged or poorly rotated, an intrusion can look like normal automation for weeks. NHI Management Group notes that 97% of NHIs carry excessive privileges and only 5.7% of organisations have full visibility into service accounts, which makes detection and containment much harder once an APT is inside. In practice, many security teams encounter identity abuse only after lateral movement has already become routine, rather than through intentional monitoring.

How It Works in Practice

APT operators usually move in stages. They start with stolen credentials, exposed secrets, phishing, or a vulnerable integration, then use that identity to probe what is reachable. If identity boundaries are weak, they can pivot from a user account to a service account, from a service account to a cloud role, and from there into privileged admin workflows. The problem is not only authentication strength. It is the combination of long-lived credentials, missing least privilege, weak session controls, and poor revocation discipline.

Practitioners should think in terms of containment layers:

• Shorten credential lifetime so stolen access expires quickly.
• Bind accounts to specific workloads, environments, and trust zones.
• Require step-up controls for privileged actions and sensitive data paths.
• Review service account entitlements as aggressively as human admin access.
• Detect impossible movement patterns, such as a low-value account reaching backup, CI/CD, or directory services.

Research from NHI Management Group’s 52 NHI Breaches Analysis reinforces that identity compromise is often the bridge between initial access and broader impact. The operational lesson is simple: an APT does not need perfect malware if it can inherit trust from poorly governed identities. Security teams should align these controls with the NIST Cybersecurity Framework 2.0 and continuously validate that access still matches business need. These controls tend to break down in hybrid estates where legacy service accounts, cloud roles, and CI/CD tokens are managed in different systems because no single owner sees the full attack path.

Common Variations and Edge Cases

Tighter identity control often increases operational overhead, requiring organisations to balance resilience against delivery speed. That tradeoff becomes most visible in environments with automation-heavy pipelines, shared platform accounts, or third-party integrations that cannot easily support per-task credentials. Best practice is evolving, but there is no universal standard for every environment yet. The current direction of travel is toward least privilege, just-in-time access, and stronger workload identity, while still accounting for legacy systems that cannot fully enforce those patterns.

Edge cases matter. Some APTs target service-to-service trust rather than end users, while others exploit dormant accounts or rarely used break-glass paths that bypass normal monitoring. In cloud and SaaS environments, an attacker may never need interactive login at all if an API key, refresh token, or federated role is available. That is why the CISA cyber threat advisories and NHI Management Group’s Ultimate Guide to NHIs both emphasize rotation, visibility, and revocation as practical defenses. The key exception is emergency access: break-glass accounts should exist, but they must be isolated, monitored, and reviewed after use, otherwise they become the easiest path for persistence.

Related resources from NHI Mgmt Group

• Why do weak identity and access controls increase cyber insurance risk for cloud and SaaS businesses?
• Why do weak identity controls increase regulatory risk in data breaches?
• Why can desktop as a service increase identity risk if controls are weak?
• Why do frequent API updates increase exposure risk for identity and access controls?