Prioritizing Identity Risks: A Mathematical Approach to Mitigating Backlog Threats

The Complexity of Identity Risk: Why Prioritization Requires a Nuanced Approach

In today’s complex enterprise environments, identity risk is no longer a simple matter of checking boxes or responding to alerts. Rather, it’s a multifaceted issue that requires a deep understanding of various factors, including control posture, hygiene, business context, and user intent.

Traditional identity programs often prioritize work based on volume, loudness, or what failed a control check. However, this approach breaks down when dealing with modern, dynamic environments where identity risk is created by a combination of factors. Any one of these factors may be manageable on its own, but the real danger lies in the toxic combination of weaknesses that can align and create a clear chain from entry to impact.

To Effectively Prioritize Identity Risk

Organizations need to adopt a framework that treats risk as contextual exposure, rather than configuration completeness. This involves evaluating four key areas:

• Controls Posture: Compliance and security controls are not just checkboxes, but rather risk signals that must be evaluated in context. Missing controls can amplify risk, depending on the identity being protected and other controls in place. Key control categories include authentication and session controls, credential and secret management, authorization and access controls, and protocol and cryptography controls.
• Identity Hygiene: Hygiene is not just about tidiness, but about ownership, lifecycle, and intent. Poor hygiene creates systemic exposure, particularly when it comes to local accounts, orphan accounts, dormant accounts, and non-human identities without ownership or clear purpose.
• Business Context: Risk is proportional to impact, not just exploitability. Organizations must consider the business criticality of applications or workflows, data sensitivity, blast radius, and operational dependencies when evaluating identity risk.
• User Intent: Identity decisions must take into account user intent, particularly in cases where agentic workflows or machine-to-machine patterns are involved. Signals such as interaction patterns, time-based anomalies, and privilege usage can help infer intent.

Identifying Toxic Combinations of Weaknesses

By evaluating these four areas, organizations can identify toxic combinations of weaknesses that pose the greatest risk. These combinations can be categorized into three levels of severity:

• Entry-Level Toxic Combos: These combinations involve missing controls, poor hygiene, and low-impact systems. Examples include orphan accounts with missing MFA or local accounts with missing audit logging.
• Active Exploitation Risk: These combinations involve orphan accounts, dormant accounts, or local accounts with recent activity, exposed credentials, or hardcoded patterns.
• High-Severity Systemic Exposure: These combinations involve orphan accounts, dormant accounts, or local accounts with missing controls, poor hygiene, and high-impact systems.

Prioritizing Identity Risk Effectively

To prioritize identity risk effectively, organizations must ask four key questions:

• What is the controls posture?
• Do we have ownership, lifecycle clarity, and purposeful existence?
• What is the impact if compromised?
• Is activity aligned with purpose, or does it signal misuse?

By prioritizing work that yields the most risk reduction, organizations can eliminate the equivalent risk of fixing dozens of low-context findings and reduce real-world breach likelihood and audit exposure. Ultimately, identity risk is not a list, but a graph of trust paths plus context.

About Author

Vaibhav

See author's posts