Reachable privilege

Expanded Definition

Reachable privilege describes the permission state that becomes available when an attacker can move from an exposed host, service, or compromised identity into a higher-value action set without needing exceptional persistence or novel exploitation. In practice, the term is about attack path realism: if a privilege can be reached through known credentials, weak segmentation, overbroad delegation, or trust chaining, it belongs in the reachable privilege surface. That makes it closely related to attack path analysis, least privilege, and post-compromise containment, but it is narrower than general access control because it focuses on what is practically obtainable after a foothold.

In identity-heavy environments, reachable privilege often emerges from dormant roles, token reuse, mis-scoped service accounts, or automation identities that can pivot into administrative actions. The concept is especially relevant to OWASP Non-Human Identity Top 10 guidance because non-human credentials frequently outlive the systems they were created for, creating hidden escalation routes. The most common misapplication is treating reachable privilege as equivalent to assigned privilege, which occurs when teams review only static entitlements and ignore what a compromised identity can actually reach.

Examples and Use Cases

Implementing reachable privilege analysis rigorously often introduces scoping and validation overhead, requiring organisations to weigh simpler entitlement reviews against the cost of tracing realistic attacker paths.

• A cloud admin role is not directly assigned to a user, but a compromised CI/CD service account can assume a deployment role with the same effective power.
• A database backup token is intended for automation only, yet it can be reused from a leaked container image to read sensitive tables.
• An exposed file-sharing server allows an attacker to harvest a machine account credential, then pivot into domain-level actions through implicit trust relationships.
• An NHI that signs internal requests has broad API reach, making it a privilege boundary concern even when the identity is “non-interactive.”
• An enterprise’s privileged access review shows no direct admin grants, but attack-path mapping reveals that NIST SP 800-53 Rev 5 Security and Privacy Controls AC-family controls are bypassed through inherited trust and shared secrets.

These examples show that reachable privilege is less about formal role assignment and more about the practical routes available after a foothold. It is also why security teams should test both human and machine identities, including service principals, API keys, certificates, and automation tokens.

Why It Matters for Security Teams

Security teams miss reachable privilege when they assume identity governance ends at provisioning. That gap leaves hidden escalation routes in place, especially where secrets are embedded in code, tokens are long-lived, or delegated administration is loosely controlled. The result is often not immediate compromise, but a fast transition from one exposed asset to lateral movement, privilege escalation, and domain control.

This concept matters across IAM, PAM, and NHI governance because attackers rarely need the “top” privilege first. They only need the privilege that opens the next door. Mapping reachable privilege helps teams prioritize remediation, reduce blast radius, and justify controls such as short-lived credentials, tighter segmentation, and token scoping. It also aligns well with control thinking in NIST governance models, where protection is evaluated not only by who is authorized, but by how access is constrained in practice.

Organisations typically encounter the consequences of reachable privilege only after an incident reveals that a low-value compromise could have turned into administrative access, at which point the concept becomes operationally unavoidable to address.

Related resources from NHI Mgmt Group

• What breaks when SAP RFC modules are reachable by low-privilege users?
• What is the principle of least privilege and how does it apply to NHIs?
• What is Zero Standing Privilege (ZSP) and how does it apply to NHIs?
• What is privilege inheritance abuse in Agentic AI?