Trending Articles
Trending Topics
Trending
For many organisations, the most challenging part of recovery isn’t restoring systems – it’s unpicking years of identity sprawl
In the aftermath of a cyberattack, the post-mortem often reveals an uncomfortable truth: the damage wasn’t just in the stolen data, but in the web of accounts, credentials and permissions that the attacker used to move around.
Accounts linger that should have been deleted, service credentials remain in forgotten scripts, and admins have long-standing “temporary” rights that no one remembers granting. This is the identity mess that surfaces after a breach – and unless it’s dealt with, it will be waiting for the next attacker.
Identity and access management (IAM) sits at the heart of modern cybersecurity, yet it’s also one of the least glamorous disciplines. But post-incident, it becomes the backbone of resilience.
The first challenge is usually the simplest in theory and hardest in practice: figuring out who has access to what.
A breach tends to reveal just how little visibility many organisations have over their identity estate. Human users, contractors, service accounts and API tokens are often spread across on-premises directories, multiple clouds and a patchwork of SaaS applications. Without a complete inventory, you can’t know which identities were abused – or which remain vulnerable.
Security teams should begin by mapping every account and its associated permissions. That includes the dormant logins of ex-employees, admin rights granted “just in case”, and the forgotten service accounts running legacy jobs. It’s not glamorous work, but it’s the only way to draw a clear perimeter again.
Once visibility is restored, attention must turn to privilege. Attackers love excessive access as every unnecessary permission widens their potential blast radius.
Every role and entitlement should have a clear purpose, with permanent admin accounts replaced by temporary, just-in-time access. Production systems need to be separated from development and test environments, and machine identities must be audited with the same rigour as human ones.
For many organisations, this stage exposes years of “permission creep”: users accumulating access as they change teams, projects and systems. It’s often faster to rebuild clean access profiles than to unwind years of accreted rights.
A recurring theme in breach reports is lifecycle failure. Employees change roles or leave the organisation altogether, yet their accounts and permissions persist. Contractors finish a project, but their credentials are never revoked. In cloud environments, temporary tokens or API keys remain valid indefinitely. Attackers notice.
A robust identity lifecycle process must be directly linked with HR systems, ensuring that access changes automatically when someone joins, moves, or leaves. Machine credentials should also have expiry and rotation policies baked in. It’s tedious governance, but it’s where the next breach is often prevented.
Healthcare organizations are under growing pressure to connect patients, providers and devices while safeguarding sensitive data, yet more IoT malware attacks and breaches make legacy IAM solutions a costly liability.
In this whitepaper, uncover five actionable IAM strategies that deliver higher customer conversion, more engagement and full 21st Century Cures Act compliance.
Cleaning up after a breach is a chance to rebuild properly. Organisations that only patch the holes are likely to find themselves leaking again before long.
That’s where zero trust principles come in. Every request for access must be verified, regardless of network location or assumed trust. Multi-factor authentication (preferably phishing-resistant), just-in-time privilege elevation and continuous risk-based verification turn IAM from a static control into a living system.
The other emerging discipline is Identity Threat Detection and Response (ITDR). By analysing behavioural data from IAM platforms, security teams can detect anomalies such as impossible logins, unusual privilege use or machine identities behaving oddly. IAM logs are integrated into broader SIEM or XDR tools to provide the same real-time detection once reserved for endpoints.
IAM isn’t just a technical clean-up; it’s a cultural one. Responsibility for identities spans HR, IT, security and business units. Without shared ownership, orphaned accounts and shadow permissions creep back in.
There’s also the human factor. When security policies become too onerous, staff often find workarounds – such as sharing accounts, using personal emails or storing credentials insecurely. The best IAM strategies pair tight technical controls with a smooth user experience: passwordless logins, automated access requests and clear communication about why these controls matter.
One of the fastest-growing blind spots after a breach is machine identity. These include scripts, APIs, containers and microservices that authenticate to each other via tokens or keys. Machine identities can now outnumber human ones by hundreds to one, and they’re often less governed.
An attacker who compromises a CI/CD pipeline or a cloud automation credential can operate with the same level of freedom as a privileged user. Cleaning up means tracking these non-human identities, rotating credentials frequently and enforcing least privilege just as strictly.
The aim isn’t to tidy up once and move on; it’s to establish IAM as a continuous discipline. Access reviews, automated provisioning and privilege monitoring must become part of daily operations, not crisis response.
Post-breach, leadership appetite for investment is usually at its peak – and that’s the moment to modernise. Consolidate identity stores, adopt centralised access governance, and introduce automation to remove the human delay between risk and response.
Done well, IAM maturity has a measurable payoff. Organisations that know exactly who can access what recover faster from incidents, pass audits with less pain, and sleep better at night. Those that don’t often find the same weaknesses waiting when the next alert hits.
A breach is never good news. But it can be a catalyst. The chaos that follows often reveals where identity really lives in an organisation – everywhere. Cleaning it up isn’t just damage control; it’s the beginning of a security culture built on clarity, accountability and least privilege.
When IAM becomes the connective tissue of security rather than its afterthought, the next breach may never happen at all.
