The article argues that traditional identity management, which prioritizes issues by volume or failed controls, is inadequate for modern enterprises. It proposes a contextual framework for prioritizing identity risk based on three compound factors: controls posture (evaluating security measures in context), identity hygiene (addressing structural weaknesses like orphaned accounts), and business context (assessing the potential impact of a compromise). The main topics are a critique of current identity programs and a detailed explanation of this three-part risk prioritization model.
Most identity programs still prioritize work the way they prioritize IT tickets: by volume, loudness, or “what failed a control check.” That approach breaks the moment your environment stops being mostly-human and mostly-onboarded.
In modern enterprises, identity risk is created by a compound of factors: control posture, hygiene, business context, and intent. Any one of these can perhaps be manageable on its own. The real danger is the toxic combination, when multiple weaknesses align and attackers get a clean chain from entry to impact.
A useful prioritization framework treats identity risk as contextual exposure, not configuration completeness.
1. Controls Posture: Compliance and Security As Risk Signals, Not Checkboxes
Controls posture answers a simple question: If something goes wrong, will we prevent it, detect it, and prove it?
In classic IAM programs, controls are assessed as “configured / not configured.” But prioritization needs more nuance: a missing control is a risk amplifier whose severity depends on what identity it protects, what the identity can do and what other controls may be in place downstream.
Key control categories that directly shape exposure:
- Authentication & Session Controls
- MFA, SSO enforcement, session/token expiration, refresh controls, login rate limiting, lockouts.
- Credential & Secret Management
- No cleartext/hardcoded credentials, strong hashing, secure IdP usage, proper secret rotation.
- Authorization & Access Controls
- Enforced access control, audited login and authorization attempts, secure redirects/callbacks for SSO flows.
- Protocol & Cryptography Controls
- Industry-standard protocols, avoidance of legacy protocols, and the forward-looking posture (e.g., quantum-safe).
Prioritization lens - missing controls don’t matter equally everywhere. Missing MFA on a low-impact identity is not the same as missing MFA on a privileged identity tied to business critical systems. Controls posture must be evaluated in context.
Top Identity Security Gaps to Find and Close
A practical checklist to help you assess your application estate and improve your organization's identity security posture by:
- Identifying which gaps are most common
- Briefly explaining why they are important to address
- Suggesting specific actions to take with existing tools/ processes
- Additional considerations to keep in mind
2. Identity Hygiene: the Structural Weaknesses Attackers (and your Autonomous Agent-AI) Love
Hygiene is not about tidiness; it’s about ownership, lifecycle, and intent. Hygiene answers: Who owns this identity? Why does it exist? Is it still necessary?
The most common hygiene conditions that create systemic exposure:
- Local accounts - Bypass centralized policies (SSO/MFA/conditional access), drift from standards, harder to audit.
- Orphan accounts - No accountable owner = no one to notice misuse, no one to clean up, no one to attest.
- Dormant accounts - “Unused” doesn’t mean safe, dormancy often means unmonitored persistence.
- Non-human identities (NHIs) without ownership or clear purpose - Service accounts, API tokens, agent identities that proliferate with automation and agentic workflows.
- Stale service accounts and tokens - Privileges accumulate, rotation stops, and “temporary” becomes permanent.
Prioritization lens - Hygiene issues are the raw material of breaches. Attackers prefer neglected identities because they are less protected, less monitored, and more likely to retain excess privileges.
3. Business Context: Risk is Proportional to Impact, not Just Exploitability
Security teams often prioritize based on technical severity alone. That’s incomplete. Business context asks: If compromised, what breaks?
Business context includes:
- Business criticality of the application or workflow (revenue, operations, customer trust)
- Data sensitivity (PII, PHI, financial data, regulated data)
- Blast radius through trust paths (what downstream systems become reachable)
- Operational dependencies (what causes outages, delayed shipments, failed payroll, etc.)
Prioritization lens - Identity risk is not only “can an attacker get in,” but “what happens if they do.” High-severity exposure in low-impact systems should not outrank moderate exposure in mission-critical systems.
4. User intent: the Missing Dimension in Most Identity Programs
Identity decisions are often made without answering: What is this identity trying to do right now, and is that aligned with its purpose?
Intent becomes critical with:
- Agentic workflows that autonomously call tools and take actions
- M2M patterns that look legitimate but may be abnormal in sequence or destination
- Insider-risk-adjacent behaviors where credentials are valid but usage is not
Signals that help infer intent include:
- Interaction patterns (which tools/endpoints are invoked, in what order)
- Time-based anomalies and access frequency
- Privilege usage vs. assigned privilege (what’s actually exercised)
- Cross-application traversal behavior (unusual lateral movement)
Prioritization lens - A weakly controlled identity with active, anomalous intent should jump the queue, because it’s not just vulnerable, it may be in use now.
The Toxic Combination: Where Risk Becomes Nonlinear
The biggest prioritization mistake is treating issues as additive. Real-world identity incidents are multiplicative: attackers chain weaknesses. Risk escalates nonlinearly when controls gaps, poor hygiene, high impact, and suspicious intent align.
Examples of toxic combinations that should be treated as “drop everything”:
Entry-Level Toxic Combos (Easy Target)
- Orphan account + missing MFA
- Orphan account + missing MFA + missing login rate limiting
- Local account + missing audit logging for login/authorization
- Orphan account + excessive permissions (even if nothing “looks wrong” today)
Active Exploitation Risk (Time-Sensitive)
- Orphan account + missing MFA + recent activity
- Dormant account + recent activity (why did it wake up?)
- Local account + exposed credentials indicators (or known hardcoding patterns)
High-Severity Systemic Exposure
- Orphan account + missing MFA + missing rate limiting
- Local account + missing audit logging + missing rate limiting (silent compromise path)
- Dormant NHI + hardcoded credentials + no audit logging (persistent, invisible machine access)
- Add business criticality and sensitive data access, and you’ve got board-level risk.
Breach Alert
- Orphan account + dormant account + missing MFA + missing rate limiting + recent activity (exit dormant stage)
- Local account + dormant account + missing rate limiting + recent activity
- Dormant NHI + hardcoded credentials + concurrent identity usage
This is the heart of identity prioritization: the toxic combination defines risk, not any single finding in isolation.
A Practical Prioritization Model You Can Use
When you’re deciding what to fix first, ask four questions:
- Controls posture: what prevention/detection/attestation is missing?
- Identity hygiene: do we have ownership, lifecycle clarity, and purposeful existence?
- Business context: what’s the impact if compromised?
- User Intent: is activity aligned with purpose, or does it signal misuse?
Then prioritize work that yields the most risk reduction, not the most checkbox closure:
- Fixing one toxic combination can eliminate the equivalent risk of fixing dozens of low-context findings.
- The goal is a shrinking exposure surface, not a prettier dashboard.
The Takeaway
Identity risk isn’t a list, it’s a graph of trust paths plus context. Controls posture, hygiene, business context, and intent are each important alone, but the danger comes from their alignment. If you build prioritization around toxic combinations, you stop chasing volume and start reducing real-world breach likelihood and audit exposure.
How Orchid Addresses It
Orchid passively discovers the entire application estate managed or unmanaged and identities via telemetry, builds an identity graph, and converts posture signals + hygiene + business context + activity into contextual risk scores. It ranks the toxic combinations that matter most, via dynamic Severity produces a sequenced remediation plan, and then drives no-code onboarding into governance (managed identities/IGA policies) with continuous monitoring, so teams reduce real exposure fast, not just close the most findings.
Note: This article was expertly written and contributed by Roy Katmor, CEO of Orchid Security.
Meridiano
