The identity kill chain is the sequence of steps an attacker follows to compromise credentials, accounts, or machine identities and then expand access across systems. In practice, it covers reconnaissance, credential theft, privilege escalation, lateral movement, persistence, and misuse of NHI, IAM, or PAM controls to reach data or critical services.
What the identity kill chain describes
The identity kill chain is not a single event, but a sequence. It starts when an attacker gathers information, then targets credentials or sessions, and uses that foothold to reach higher value access, deeper systems, or more durable control.
That sequence matters because identity compromise often looks legitimate at each step. A stolen password, token, or service credential can be used in ways that blend into normal administration, especially when machine identity and service-account usage are already part of the operating model.
Common stages in the attack sequence
Most identity kill chains reuse a familiar pattern: reconnaissance to identify useful accounts or trust paths, initial access through credential theft or phishing, privilege escalation, lateral movement, and persistence through reused secrets, delegated rights, or unattended accounts.
In practice, the attacker is looking for the shortest route from one compromised identity to many systems. The value of the chain is not only the first compromise, but the ability to pivot into shared administration, cloud control planes, directory services, SaaS platforms, or automation accounts.
Why the identity kill chain is dangerous
Identity compromise is powerful because it turns access into authorization. Once an attacker can act as a user, admin, service, or workload, they can often read data, change settings, mint new credentials, or create durable access paths that survive the original breach.
This is why identity attack paths are often treated as a core defensive concern in threat modelling. MITRE ATT&CK Enterprise Matrix is useful here because it maps the tactics most often seen in the chain, especially credential access, privilege escalation, lateral movement, and persistence.
How organisations reduce exposure
Defenders break the chain by removing easy privilege accumulation and by making trust paths visible. That means inventorying accounts, service identities, secrets, and delegation paths, then checking where credentials are exposed, where privileges are excessive, and where long-lived access still exists after its original business need has ended.
For organisations that need a practical lifecycle view, NHI Lifecycle Management Guide is a useful companion because it covers provisioning, rotation, offboarding, visibility, and access governance for identities that attackers often abuse.
Risk and Threat Considerations
The identity kill chain is dangerous because each step can hide inside normal-looking activity. A compromised account may begin with a single login, then evolve into privilege escalation, token theft, and reuse of delegated access across multiple environments before defenders notice.
Failure mechanism: Attackers exploit weak identity hygiene, shared trust, stale permissions, and reusable secrets to move from one compromised identity to broader administrative control.
Impact: The result can be data exposure, service disruption, persistence that survives password resets, and broader compromise of cloud, directory, or automation layers.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK and OWASP Non-Human Identity Top 10 define the specific risk controls and attack patterns relevant to this term.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1003 — OS Credential Dumping | Identity kill chains often begin with credential access used to expand trust. |
| T1021 — Remote Services | Lateral movement is a core stage in identity kill chains across hosts and services. | |
| T1078 — Valid Accounts | The term centers on misuse of legitimate accounts after compromise. | |
| Recommendation — Hunt for credential access and block reuse paths that enable escalation. Monitor remote service use for identity-driven lateral movement and isolate suspicious paths. Detect abnormal valid-account use and revoke compromised access quickly. | ||
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | Excess privilege is a common way attackers convert one identity compromise into wider access. |
| NHI-07 — Long-Lived Secrets | Persistent secrets help attackers retain access after the initial compromise. | |
| Recommendation — Reduce standing privilege so stolen identities cannot fan out across systems. Rotate and shorten secret lifetime to limit post-compromise persistence. | ||
Practitioner Guidance
What to watch for: Treat unexpected privilege growth, unusual token use, new delegation paths, and identity activity that crosses normal administrative boundaries as warning signs, not isolated anomalies. The important question is often not whether one account was compromised, but whether that account can be used to reach other identities, services, or control planes.
Practitioner takeaway: Identity defence works best when you assume the first foothold is only the beginning and design controls to interrupt escalation, reuse, and persistence at every stage.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 23, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org