Identity security: a guide for security leaders

According to the Netwrix 2026 Data and Identity Security Report, a survey of 2,317 IT and security professionals found that 75% of sensitive data exposures begin with compromised identities or misconfigured permissions.

Valid-looking access can carry risk long after provisioning, which makes identity security a cyber resilience and business governance concern rather than a purely technical one.

At an organization with 100-5,000 employees, answering a board member or external auditor who asks who has access to what, or whether the organization is secure, often requires manual reconciliation. The underlying data lives in Active Directory (AD), Microsoft Entra ID, multiple SaaS admin consoles, and spreadsheets, and those records often disagree.

A disciplined program turns that fragmented data into a measurable posture that security teams, boards, and auditors can use. Continuous governance then supports faster response, defensible access decisions, and clear evidence of progress.

What is identity security?

Identity security is the ongoing practice of protecting every identity in the organization from compromise and misuse. It identifies where granted access creates risk, monitors how that access is used, and interrupts anomalous identity activity. The scope covers employees and contractors as well as service accounts, application identities, and AI agents.

Identity and access management (IAM) is the related discipline that enables the right people or machines to access the right assets at the right time and for legitimate reasons. IAM handles provisioning, deciding who gets what and setting it up.

Identity security follows that decision, applying prevention before an attack and detection and response once one is underway. IAM builds the structure, and identity security defends it.

Why identity security is a board-level risk now

Boards need specific, measurable evidence to manage identity exposure as part of the organization's cyber resilience posture. Three forces have recently raised the stakes.

Nearly half of organizations had a cloud account compromise last year

The Netwrix 2026 Data and Identity Security Report found a 43% breach rate over the previous 12 months among organizations where AI had significantly increased the identity footprint, compared with 11% among those where it had not meaningfully changed. Each added identity is another credential an attacker can use. Valid cloud tenant credentials let an attacker read email, pull data, and move between SaaS services without triggering controls built for network perimeters.

Identities and permissions govern the paths attackers follow to data

Where sensitive data exposures originate is a separate question from how attackers first gain entry. In Verizon's 2026 Data Breach Investigations Report (DBIR), vulnerability exploitation (31%) overtook credential abuse (13%) as the top initial access vector. Credential abuse still appeared in 39% of breaches at some stage.

Once inside, whether through an exploit or a stolen password, access to data runs through identities and permissions. Firewall controls govern network traffic, while identities and permissions govern data access.

Insurers are already pricing this risk into renewals

Among insured organizations, The Netwrix 2025 Cybersecurity Trends Report found that demand for IAM rose from 38% in 2023 to 48% in 2025. Renewal cycles now include identity-specific questions, and premiums reflect the answers.

The questions identity security has to answer

A workable program answers four practical questions in terms boards, and auditors can evaluate:

1. Who holds effective access right now?
2. Is that access being used normally?
3. Can access decisions be defended later?
4. Does access get removed on time?

Supporting disciplines include privileged access management (PAM), identity governance and administration (IGA), identity threat detection and response (ITDR), and identity security posture management (ISPM).

Who has access to what, right now, across every system?

Teams commonly answer this question one system at a time. The AD team pulls group memberships, the Microsoft 365 admin exports role assignments, and each SaaS owner has a console. What is missing is a single current picture across AD, Microsoft Entra ID, SaaS, and cloud, with nested group membership resolved to the access a person effectively holds. The answer usually requires additional reconciliation after the meeting.

Is that access being used the way it's supposed to be?

Behavior still needs separate verification when a person uses an account outside expected hours, even if the account has the right permissions. Credential theft, lateral movement, and privilege escalation can look like permitted activity from an entitlement standpoint, because the account does things it's allowed to do but in a sequence and at a tempo inconsistent with legitimate admin behavior. Answering this question requires behavior analysis over time, which is ITDR's job.

Can we show why access was appropriate, after the fact?

When teams can't reconstruct a valid access decision later, the organization lacks the evidence an auditor expects. The organization needs a record of who requested the access, who approved it, and when someone last reviewed it. That record connects the original decision to the current entitlement.

Does access get removed when it's supposed to?

Written policy and directory state can drift apart quickly. Standing privileged access that outlives its reason, a contractor account still active after the project, and a service account whose owner left long ago each leave entitlements in place that no one would reauthorize today.

The Netwrix 2026 Data and Identity Security Report found that 76% of organizations can't immediately revoke standing access when it is no longer needed, a problem leaders can address with stronger lifecycle controls.

The core components of identity security

Identity security divides the work among provisioning, privilege, governance, detection, and the directory they all depend on, in the order each discipline enters the access lifecycle.

IAM: the umbrella that grants and manages access

IAM covers the systems and processes that decide who gets access to what and then provision it, including directories, single sign-on, MFA, and access requests. Security controls build on what IAM grants by reviewing issued entitlements for signs of compromise, misuse, or accumulated risk.

PAM: the privileged subset that can do the most damage

Privileged access management governs accounts that can change the environment itself, including domain admins, cloud global administrators, and service accounts with elevated rights. PAM tooling applies stronger technical controls over the accounts, credentials, and commands used to administer or configure systems and applications.

Organizations use separate tooling and session recording for this narrow, high-stakes access because insurers and auditors scrutinize it more closely than standard user access. The Netwrix Cybersecurity Trends Report 2025 found that 42% of IT professionals would prioritize improving PAM over all other security initiatives if given the choice.

IGA: the governance layer that checks access still makes sense

Identity governance and administration provides the periodic review layer. Where IAM provisioning looks forward because a person needs a role today, IGA looks back and asks whether access someone received 18 months ago is still appropriate and what the team should have revoked already. Core IGA features include identity lifecycle management, access certification, and access request processing. For audit purposes, IGA produces certification records that show someone reviewed access.

ITDR: watching for compromise after access is granted

Identity threat detection and response provides the real-time layer. Gartner introduced the category in 2022. It detects credential theft, lateral movement, and privilege escalation as they happen. IGA and PAM govern whether teams set up access correctly, while ITDR identifies misuse after access exists.

Directory security: Protecting the system every identity depends on

Active Directory and Entra ID form the foundation for the other disciplines. A compromised or misconfigured directory undermines all of them at once because directory control changes the source of truth for every identity.

The Five Eyes guidance Detecting and Mitigating Active Directory Compromises, first published in September 2024 and since revised, warns that gaining control of Active Directory gives malicious actors privileged access to all the systems and users it manages.

Where identity security fits with Zero Trust

The Cybersecurity and Infrastructure Security Agency (CISA) puts identity at the center of continuous verification. CISA's Zero Trust Maturity Model makes identity the first of its five pillars, with an Optimal stage in which an organization continuously validates identity throughout access using phishing-resistant MFA.

Continuous validation, least privilege, and re-evaluating trust during a live session are all identity security work. A Zero Trust strategy aligned with CISA's model depends on the strength of the identity controls carrying it out.

How to assess where your organization stands

Three exercises produce a defensible baseline using tooling the team already has. A timed visibility test, a privileged-access approval review, and an independent directory scan each yield a specific artifact the team can hand to leadership or an auditor.

Run a one-day effective-access visibility test

Ask the team to answer "who has access to what, right now, across every system" within one working day. Record the number of consoles touched, the time required, and any systems the team could not cover. Done looks like a single reconciled list of effective access per user, or, failing that, a documented list of the blockers that prevented producing one. Both outcomes belong in the board narrative later.

Review standing privileged access for approvals nobody remembers giving

Pull the full list of accounts with elevated rights, including service accounts and accounts that inherit admin rights through nested groups. For each account, identify who approved it, when approval occurred, and why the access remains active.

Done looks like a spreadsheet with an approval record attached to every entry and a shortlist of accounts to revoke. Cybersecurity Maturity Model Certification (CMMC) Level 2 assessors ask for exactly this artifact set, including a list of active system accounts tied to named individuals and the corresponding access authorization records, so the exercise doubles as audit preparation.

Run an independent directory scan against a standard checklist

Score the directory with an external scan, such as a MITRE ATT&CK-mapped assessment or one built on the AD compromise techniques in the Five Eyes guidance, to produce an independent baseline. Done looks like a ranked list of misconfigurations, including the ones that let an ordinary user escalate to admin and the accounts attackers can target without an interactive login.

Translating identity security into board and audit language

Funding depends on translating identity findings into exposure, response time, and defensible evidence a board can act on. The National Association of Corporate Directors' (NACD's) Director's Handbook on Cyber-Risk Oversight, fifth edition (2026), assigns management that translation responsibility.

The metrics that work in a board conversation

A vulnerability count measures effort, while a board needs to see exposure. Time-based identity metrics provide that view, translating technical activity into a risk timeline a nontechnical director can evaluate. NACD lists these among the metrics to report at least quarterly and immediately following any material incident:

• Mean time to detect (MTTD): How long a compromised identity goes unnoticed, the window during which an attacker can move laterally or escalate privileges undetected.
• Mean time to respond (MTTR): How long it takes to revoke unnecessary or compromised access once it's flagged, a direct measure of how fast the organization closes an opening.
• Share of high-cost incidents: The Netwrix Cybersecurity Trends Report 2025 found that the share of organizations reporting $200,000-plus in attack damage nearly doubled, from 7% in 2024 to 13% in 2025. That trend gives MTTD and MTTR a business cost to anchor against.

Evidence auditors expect to see

Accurate access decisions and evidence of those decisions are separate audit requirements. System and Organization Control 2 (SOC 2) criterion CC6.2 requires removing user system credentials when access is no longer authorized, and AICPA's Trust Services Criteria set the standard SOC 2 auditors test against.

A review typically traces two kinds of evidence:

• Provisioning and termination records: a sample of access-granting and access-removal events traced back to approved tickets, with delayed removals written up as exceptions.
• Access review documentation: the reviewer's name, the review date, the systems covered, and manager sign-off, recorded for every periodic review, not just the initial grant.

A verbal assurance leaves these tests unsupported. Auditors treat a timestamped export from the system of record as reviewable evidence.

Turning findings into a risk narrative instead of a punch list

When teams present directory findings as a technical backlog, a board can easily treat them as routine maintenance. Framing the same findings around operational outcomes makes the risk and remediation goal clearer.

For example, "standing domain admin access lacks traceable approval" becomes "removing unneeded standing access narrows the paths to directory-wide control and makes approvals auditable."

How Netwrix supports identity security in practice

Netwrix builds controls across the identity lifecycle for hybrid Microsoft environments, from directory assessment and posture visibility to activity recording, privilege enforcement, threat detection, and real-time blocking. Each product maps back to one of the four questions this guide opened with.

Scoring directory exposure with an external baseline

Netwrix PingCastle assesses, scores, and ranks AD risk through 170+ MITRE ATT&CK-mapped checks, producing the kind of independent baseline the directory scan above calls for. Because directory control underpins every other identity discipline, a prioritized PingCastle score turns a broad Microsoft directory problem into a measurable work list a technical buyer can act on.

Keeping a current picture of identity risk

Netwrix Identity Security Posture Management (ISPM), delivered through the Netwrix 1Secure™ Platform, surfaces misconfigurations across AD and Microsoft Entra ID with 170+ checks and keeps posture visibility current, giving teams a picture that changes with the environment instead of lagging behind the last manual reconciliation.

That is what answering "who has access to what, right now" requires. The SaaS delivery model removes infrastructure provisioning from the setup effort.

Shortening investigation time with hybrid activity records

Netwrix Auditor records change and access activity across AD, Microsoft 365, file systems, and other platforms. That record gives teams the evidence trail that answering "can we show why access was appropriate" depends on, along with a faster way to spot activity that falls outside normal patterns.

Enforcing least privilege for high-stakes accounts

Netwrix Privilege Secure answers "does access get removed on time" for privileged accounts directly. It replaces standing admin rights with just-in-time access for a specific task, removes it automatically when the task ends, and records the resulting sessions for audit review.

Eastern Carver County Schools eliminated standing admin access to systems holding data for 9,300 students, replacing it with just-in-time access, and completed the rollout in days rather than months.

Catching misuse of access as it happens

Netwrix Threat Manager answers, “Is that access being used normally in real time?” It detects credential theft, lateral movement, privilege escalation, Kerberoasting, Golden Ticket attacks, and other identity threats across AD and Microsoft Entra ID environments, with additional coverage for Active Directory Certificate Services (AD CS) ESC1-ESC7 techniques.

Netwrix Threat Prevention goes further by blocking DCSync, Kerberoasting, and Pass-the-Hash attacks in real time. Splitting detection and blocking across two products keeps controls distinct while protecting Tier Zero assets such as privileged groups, domain controllers, and Group Policy Objects (GPOs).

Know where your identities stand

Effective-access visibility across hybrid Microsoft environments, traceable governance evidence, current posture information, and timely detection or containment should drive identity security investment.

Compare written policy with directory state to establish a baseline, then use the one-day visibility test, privileged-account review, and independent scan to identify where the next investment will have the greatest impact.

Request a demo to see how Netwrix can help you map effective access across hybrid Microsoft environments, eliminate standing privileged access, and detect identity threats in real time.