Loading story…
Organizations are facing increasing risks from complex entitlement structures and the rapid proliferation of business applications, which challenge the effectiveness of identity governance and administration (IGA) systems. When employees accumulate multiple entitlements—often due to overlapping roles or inadequate joiner, mover, and leaver processes—these combinations can create toxic access paths that violate separation of duties and expose sensitive information. Such entitlement entanglements can lead to privilege escalation, undermine auditability, and increase the risk of both accidental and intentional misuse of access rights.
At the same time, enterprises are struggling to keep pace with the explosion of applications, with many organizations using over 1,000 apps but integrating only about half with their IGA solutions. This gap in app integration makes it difficult to manage entitlements comprehensively, increasing the attack surface and complicating access reviews. Industry research highlights the need for improved onboarding of applications into IGA frameworks and more robust entitlement management to address these growing identity security challenges.
Get the actors, campaigns, and ATT&CK mapping behind it.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Organizations are facing a new wave of security challenges as internally built no-code applications and AI agents proliferate across enterprise environments. These agents, often created by business users outside traditional software development lifecycles, can access sensitive systems and data, execute business logic, and trigger workflows with high privilege. Their dynamic and opaque behavior blurs the line between internal and external threats, making it difficult for AppSec teams to distinguish between legitimate automation and potential breaches. Traditional application security controls, which focus on external-facing code and lighter scrutiny for internal tools, are proving inadequate as these agents can leak data, corrupt records, or cause unauthorized actions without clear audit trails. Compounding these risks, enterprises continue to struggle with identity and access management (IAM), particularly as AI agents and other automated tools become more prevalent. Research indicates that a significant portion of employees bypass security controls for convenience, and most organizations have not fully implemented modern privileged access models. Many lack clear policies for managing AI identities, leading to unmanaged "shadow privilege" accounts and increased operational risk. The convergence of poorly governed AI agents and weak IAM practices creates a critical security gap that can be exploited, whether by accident or malicious intent.
Jun 29, 2026
Enterprises are facing significant challenges in managing the rapidly expanding attack surface created by both human and non-human identities. Reports highlight that permissions and entitlements are growing at a pace that outstrips the ability of security teams to maintain oversight, with hundreds of millions of active entitlements and billions of permissions in large organizations. This complexity leads to persistent blind spots, including dormant and orphaned accounts that remain active and pose a risk for misuse, as well as the accumulation of 'identity debt' where excessive and unused access quietly increases risk over time. Non-human identities (NHIs), such as machine accounts, tokens, and keys, are becoming increasingly critical in cloud environments. Effective management of these NHIs is essential for reducing risk, improving compliance, and increasing operational efficiency. Automation and centralized secrets management are emphasized as key strategies for maintaining visibility and control over both human and non-human identities, helping organizations address security gaps and reduce operational costs associated with manual oversight and credential management.
Jun 29, 2026
Security teams are reporting a growing loss of certainty in **identity and access management** as enterprises accumulate large numbers of poorly governed identities across cloud platforms, CI/CD pipelines, and automation frameworks. The reporting describes this as **identity sprawl**—a systemic drift where identity creation, usage, and governance fall out of sync with traditional lifecycle and access review models designed for predictable human users. A key driver is the rapid proliferation of **non-human identities** (service accounts, APIs, workloads, and increasingly autonomous/agentic systems) that can be created and discarded in seconds, outpacing visibility and privilege management controls. The articles cite investigations and threat analysis indicating attackers are **weaponizing exposed identity data at scale**, and report survey data that **72% of identity leaders** say the threat level of identity-related attacks increased or stayed the same over the past year.
Jun 29, 2026