Proxy-based persistence is sustained access achieved through a trusted intermediary rather than obvious direct privilege. For cloud identity programmes, the challenge is that the user or role may appear constrained even while the intermediary continues to carry meaningful operational authority.
How Proxy-Based Persistence Works
Proxy-based persistence is sustained access through an intermediary that remains trusted, permitted, or overlooked. The attacker does not need to look like a direct admin to keep influence, because the intermediary carries the operational authority.
That intermediary might be a delegated role, a service, an integration, or another trusted path in the environment. The key idea is not stealth by hiding in plain sight alone, but durability through a legitimate relationship that continues to function after the original compromise point has changed.
Why It Is Hard to Notice
Proxy-based persistence often evades simple account-centric review because the visible user or role can appear constrained while the proxy path still works. In cloud identity and access environments, that means permission review may miss the real continuation of access if reviewers focus only on the surface principal instead of the trust relationship it can activate.
It also creates an attribution problem. The action appears to come from an approved intermediary, so logs may not obviously show a classic takeover pattern even when the underlying access path has become a durable control bypass.
Common Forms and Security Mechanisms
This pattern commonly appears where delegation, federation, impersonation, token exchange, or service-to-service trust is available. The mechanism itself is not inherently bad, but it becomes persistent when the intermediary’s authority outlives the security assumption that introduced it.
In practice, proxy-based persistence can sit close to identity and authorization controls. A trusted bridge may preserve access even after password resets, role cleanup, or partial remediation, especially if the intermediary was not fully inventoried or if its standing authority was broader than expected.
For that reason, it is useful to evaluate both the original principal and the proxy path. Identity Threat Detection and Response (ITDR) Guide is relevant here because persistence through trusted identity paths is a detection and response problem as much as an access problem.
What It Means for Defense
Defending against proxy-based persistence means understanding which intermediaries can continue to act, not just which accounts are directly privileged. Where access is mediated through trust, defenders need to verify the continuity and scope of that trust, not only the apparent permissions of the user at the edge.
This is why Salt Typhoon telecom intrusions 2025 is a useful reference point: it shows how trusted access paths and recovered credentials can support long-lived persistence even when the initial compromise is not the whole story.
Zero-trust thinking is especially relevant because the control question is not whether an intermediary was once trusted, but whether it should still be trusted now. A proxy that keeps working after the environment changes is a persistence surface, not just a convenience feature.
Risk and Threat Considerations
Proxy-based persistence is risky because it can preserve attacker access even after obvious credentials are rotated or a visible account is remediated. The durable path is often the intermediary, not the compromised identity itself, which makes containment slower and can leave the environment looking cleaner than it really is.
Failure mechanism: A trusted intermediary continues to carry authority, allowing access to survive direct cleanup of the original compromise and enabling the attacker to re-enter through a legitimate-looking path.
Impact: Incident response can miss the true persistence layer, leading to repeated compromise, wider lateral movement, and longer dwell time.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Proxy persistence often survives poor credential and token lifecycle control. |
| AC-6 — Least Privilege | Proxy-based access becomes persistent when an intermediary retains more authority than needed. | |
| AU-6 — Audit Record Review, Analysis, and Reporting | Investigating proxy persistence depends on correlating intermediary activity with the originating actor. | |
| Recommendation — Tighten authenticator lifecycle controls to remove durable access paths that survive direct account cleanup. Reduce intermediary authority to the minimum permissions required for the approved task. Correlate logs for delegated and proxy actions to expose the real persistence path. | ||
| NIST CSF 2.0 | PR.AA-05 — Identity Management, Authentication, and Access Control | The term centers on access that persists through trusted identity relationships. |
| Recommendation — Review and constrain identity pathways that let an intermediary retain effective access. | ||
| MITRE ATT&CK | T1098 — Account Manipulation | Persistence via trusted intermediaries aligns with adversary modification of access relationships. |
| Recommendation — Hunt for manipulated trust relationships and delegated access used to maintain persistence. | ||
Practitioner Guidance
What to watch for: Review whether an access path is still needed, still bounded, and still traceable to an accountable owner. Proxy-based persistence is easiest to miss when teams validate the visible identity but not the intermediary relationship that actually preserves access.
Practitioner takeaway: Treat trusted intermediaries as first-class persistence candidates in cloud identity reviews, because removing the direct account does not always remove the effective access path.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 12, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org