Identity blind spots put business security investments to the test

Australian businesses investing heavily in cybersecurity face a deceptively simple question. Do they know who, or what, can access their most sensitive systems?

The answer is becoming harder to establish as corporate networks fill with employee accounts, service accounts, cloud workloads, software credentials and autonomous AI agents. Each identity can carry permissions that allow it to retrieve information, change systems or open pathways into other parts of the organisation.

For boards and executives, the concern extends beyond keeping an accurate register. An incomplete understanding of access can leave businesses exposed despite substantial spending on security controls.

Traditional identity and access management systems remain essential. However, tools designed primarily around employees and relatively stable infrastructure can struggle to provide a complete picture of increasingly diverse and interconnected digital identities. The result is a gap between the access an organisation believes it has authorised and the access that exists in practice.

Fragmented systems mean accumulated risk

Many organisations have invested in identity governance, privileged access management and cloud identity security tools. Each serves a purpose however their information often remains scattered across directories, software development environments and production workloads.

Realistically, one system records which accounts have been created while another tracks who approved access. A third manages elevated privileges, while separate tools examine cloud permissions or identify unusual behaviour. Bringing those records together is critical because a seemingly modest permission in one environment can become dangerous when combined with access and entitlements elsewhere.

A dormant employee account, for example, may retain privileged permissions long after its owner stopped using it, while a service account supporting an application could provide an attacker with lateral movement across several systems. Meanwhile, an AI agent might hold standing privileges to sensitive information without clear human oversight.

These exposures are difficult to address when security teams cannot connect accounts and privileges across the organisation and environments. They also complicate the enforcement of least privilege, the principle that identities who should receive only the access required to perform their assigned tasks.

Businesses cannot reliably remove unnecessary permissions if they cannot determine where those permissions exist. For executives, this creates a practical management problem when security spending does not automatically translate into a clear understanding of the company's risk exposure.

From visibility to intelligence

An evolving category of security technology seeks to close that gap by combining identity information with analysis of relationships and entitlements, privileges, rights and permissions. Known as identity visibility and intelligence platforms (IVIP), these systems are intended to provide an analytical layer across existing identity controls and across multiple complex environments. Their value lies in showing what an account can actually do, including the access it could gain through connected systems if access is abused.

The distinction matters when security teams face more findings than they can immediately investigate. A dashboard showing hundreds of stale privileged accounts offers visibility, however an analysis identifying the handful most likely to provide a pathway into production systems gives teams a basis for deciding where to act first. Such prioritisation can help executives assess which exposures require immediate attention, which should be escalated, and which can be managed through a planned remediation program.

A useful platform therefore needs to combine account information, entitlements, configuration weaknesses and user behavioural signals. It must also reveal relationships between human users, workloads, machine identities and agentic AI.

For procurement teams, this means looking beyond the breadth of integrations. They need to establish whether findings explain why an identity is dangerous and whether the platform covers the accounts their business actually uses, verses ones that are dormant or forgotten. Fast deployment matters as well, but sustained insight must support measurable improvements in access management everywhere.

The commercial test is whether that combined information improves decisions and reduces exposure, as adding another dashboard without affecting security outcomes offers limited value. Australian organisations should therefore judge identity investments by their ability to answer concrete questions about access, accountability and potential compromise and drive change in lieu of just documenting them.

The objective therefore is to identify consequential exposures early, connect findings to existing controls and ensure someone owns the response to lower the organisation’s identity risk surface. As digital identities multiply, that discipline will become increasingly important to protecting the value of any, and all technology investments.

*Morey Haber is the Chief Security Advisor at BeyondTrust and has more than 25 years’ IT industry experience. During this time, he has authored four books: Privileged Attack Vectors, Asset Attack Vectors, Identity Attack Vectors, and Cloud Attack Vectors. He is a founding member of the industry group Transparency in Cyber, and in 2020 was elected to the Identity Defined Security Alliance (IDSA) Executive Advisory Board. He currently oversees BeyondTrust security and governance for corporate and cloud-based solutions.

Top image credit: iStock.com/BlackJack3D