Identity and attack paths - can you stop hackers getting from A to B? — TechRadar

RESOLVING THE LEDGER

Identity and attack paths - can you stop hackers getting from A to B? — TechRadar | AIPROPX

IT security has traditionally been about keeping threat actors out and preventing breaches. However, while the volume of software vulnerabilities has gone up and up over the past few years, the biggest risk that many companies face is not about a hacker getting in. Instead, it is how long they can stay inside and how far they can move within that network.

The reason why threat actors can move laterally is how difficult it is to manage identities effectively. Identities and credentials are used all the time to allow access, but they also serve as ways to support provisioning and software deployment processes. Simple software tokens that can make life easier for staff are targeted for the access and permissions that they provide.

Companies are waking up to this threat. Omdia research estimates that spending on identity management will increase at 75 percent of organizations during 2026, compared to 57 percent in 2025. But what issues have to be resolved, and what is the fastest way to get to those resolutions?

Understanding attack paths and identity

Threat actors want to make money. They do this by stealing company data or encrypting files for ransom. They achieve their goals through getting initial access in one place - an endpoint that is missing an update, or through a phishing email and malware download, for instance. After this, they want to move laterally through the network to something valuable.

For defenders, this lateral movement, or attack path, represents an opportunity to deny access or block attacks. Attackers use the same methods that legitimate staff have to access assets: their identities. For many attackers, there is no need to use zero day attacks when they can simply log in and get what they want, or move closer to their goal.

Understanding attack paths can be hard. For defenders looking at the business crown jewels like Intellectual Property or mission-critical applications, attack paths are often visualized as direct routes from an initial access point to those valuable assets. While this is simple to understand, attackers don’t work that way.

They don’t know your internal network topology or the most direct route to what is valuable. Instead, they are sniffing out what they can access.

This is made more complicated because each account will have its own level of access, and different accounts will have more or less permissions. Each asset will have multiple accounts that can access it. The complexity scales up rapidly as networks grow larger.

For organizations with around 1,000 employees, we estimate that they have more than 5 million attack paths. Companies also have to reckon with the number of identities they have in place - an organization with 10,000 identities would have around 22 million potential attack paths to manage.

Attack path problem compounded by AI and NHIs

Adopting Artificial Intelligence (AI) and Non-Human Identities will increase this further, from the current ratio from around five identities per employee towards 20 or 40 identities per human employee . This imminent surge of identities will then grow at an expected 20 percent year on year.

That is a lot of numbers. To put this into perspective, looking at how you understand maps and graphs can help. For example, London has 330 stations in its public transport network covering the underground and rail networks, as well as buses and riverboats.

There are millions of different routes that travelers can take to get from any place, from the fastest and obvious journeys through to more circuitous and obscure routes that don’t make sense except in context. Travelers can also shift from one kind of transport network to another where they need to. Understanding all those networks, timetables and options is very hard for someone to hold in their brain all at one.

Using a map can show up the best routes and directions to take, including those paths that are a combination of different networks. From a defense perspective, understanding the most high profile locations in that network and where security is most important can help prevent attacks. Looking at attack paths and permissions, you can see the most important locations within the network based on the level of access that they have.

In the London transport network, this would be the equivalent of security at Piccadilly Circus or King’s Cross St Pancras, as these stations are the busiest. Securing those specific nexus points can prevent an attacker taking more potential routes to something valuable, reducing the risk that attackers can get to mission-critical systems or data. Once you have locked down those central hubs, you can then look for the next major point and secure this one as well.

Getting to a secure future

This process around locking down identities and access permissions removes whole swathes of potential attack paths, rather than looking at each attack path one after another.

There are too many individual paths to manage, so corralling issues and securing those environments as a whole reduces the number of ways that threat actors can move across a network. This forces attackers to make their presence more obvious, leading to them being removed from the network.

Attacks on IT are getting faster. Trying to fix all the gaps that exist is now impossible, and defenders cannot achieve perfect security. We need to live with these imperfections, and manage security as effectively as possible in advance of any issue coming up.

While security teams might be used to defending the direct paths between systems, threat actors look for the other routes that can get them to where they want to go. Instead, we have to manage our networks based on preventing both the most risks and the most impactful risks.

By understanding attack paths and identity risks, we can look at what the highest priority issues are and then secure them. Using identity attack paths, we can understand where the risks exist and what work needs to be done.

We've ...