{"id":14455,"date":"2026-07-21T10:04:31","date_gmt":"2026-07-21T10:04:31","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2026\/07\/21\/the-privilege-paths-attackers-see-that-you-dont-a-complete-pam-guide\/"},"modified":"2026-07-21T10:04:31","modified_gmt":"2026-07-21T10:04:31","slug":"the-privilege-paths-attackers-see-that-you-dont-a-complete-pam-guide","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2026\/07\/21\/the-privilege-paths-attackers-see-that-you-dont-a-complete-pam-guide\/","title":{"rendered":"The Privilege Paths Attackers See, That You Don\u2019t \u2013 A Complete PAM Guide"},"content":{"rendered":"

The Privilege Paths Attackers See, That You Don\u2019t \u2013 A Complete PAM Guide
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

Why identity fragmentation is the blind spot behind most breaches\u2014and what a platform approach changes<\/em><\/p>\n

The Identity Problem Hiding in Plain Sight<\/strong><\/h2>\n

Identity is at the centre of nearly every major breach\u2014yet most organisations still can\u2019t answer one fundamental question:\u00a0what is the total effective privilege of any given identity, and how could an attacker chain it into something dangerous?<\/em><\/strong><\/p>\n

The numbers tell a clear story. Credential abuse still appears in\u00a039% of all breaches<\/strong>, according to the\u00a02026 Verizon Data Breach Investigations Report<\/strong><\/a>\u2014even as vulnerability exploitation rises as an initial access vector. Meanwhile, non-human identities\u2014service accounts, API keys, machine credentials, and AI agents\u2014now\u00a0outnumber human users by ratios of 45:1 to 80:1<\/strong>\u00a0in the average enterprise, according to research from\u00a0Rubrik Zero Labs<\/strong><\/a>\u00a0and KPMG. And 97% of those machine identities carry excessive privileges beyond what their function requires.<\/p>\n

If you\u2019re a security leader, you\u2019ve felt this tension firsthand: more tools than ever, less clarity than ever about who\u2014or what\u2014actually has access to your crown jewels.<\/p>\n

Paths to Privilege\"\u2122\": The Risk Nobody Can See End to End<\/strong><\/h2>\n
\"\"<\/figure>\n

The real risk isn\u2019t a single over-permissioned account. It\u2019s the chain.<\/p>\n

A standard user account rarely leads directly to Tier-0 assets. But a nested Active Directory group membership, combined with a cached local admin credential, a stale service account, and an over-permissioned cloud IAM role, can quietly assemble into a complete escalation path\u2014what BeyondTrust calls a \u201cPath to Privilege.\u201d<\/p>\n

Here\u2019s a realistic scenario:\u00a0<\/strong>an attacker compromises a marketing contractor\u2019s VPN credentials through an infostealer\u2014a vector that affected 30% of corporate devices in 2025, per\u00a0SpyCloud. <\/p>\n

That contractor account inherits local admin rights on a shared workstation through three-levels-deep group nesting. From that workstation, a cached service account credential provides lateral movement to a file server, which holds an API key for a production cloud environment. Four hops, four different tools\u2019 blind spots, one complete breach.<\/p>\n

These indirect paths are invisible to point tools that only see their own slice of the environment. Your directory team sees Active Directory. Your cloud team sees IAM roles. Your endpoint team sees local admin rights. DevOps sees secrets and SSH keys.\u00a0No single team sees the chain that connects them.<\/strong><\/p>\n

The Non-Human Identity and AI Multiplier<\/strong><\/h2>\n

This problem is growing fast\u2014and it\u2019s not because of human users.<\/p>\n

Non-human identities grew\u00a044% year-over-year<\/strong>\u00a0between 2024 and 2025, per\u00a0Entro Labs research. The average enterprise now holds over 250,000 machine identities across cloud environments. In cloud-native and DevOps settings, the NHI-to-human ratio reaches\u00a0144:1<\/strong>. Nearly half of these identities are over one year old with no credential rotation.<\/p>\n

Now add agentic AI to the mix. Every AI agent your organisation deploys becomes a new privileged actor\u2014often with API keys, cloud entitlements, and data access that rival a human administrator\u2019s. These agents are created faster than security teams can govern them, and most inherit the access permissions of the human or system that spawned them\u2014with no expiry, no review, and no audit trail.<\/p>\n

This is the identity blind spot that will define the next wave of breaches: an ungoverned, over-privileged population of machine and AI identities that nobody can see end to end.<\/p>\n

One Platform. Complete Privilege-Centric Identity Security.<\/strong><\/h2>\n

BeyondTrust built the\u00a0Pathfinder Platform<\/strong><\/a>\u00a0to solve this fragmentation\u2014bringing Privileged Access Management (PAM), Identity Threat Detection and Response (ITDR)<\/strong><\/a>, Cloud Infrastructure Entitlement Management (CIEM), Secrets Management, and Secure Remote Access into a single console with one shared data platform.<\/p>\n

\"\"<\/figure>\n

The distinction from a \u201csuite\u201d is architectural. Every module feeds identity, access, session, and privilege telemetry into a common data plane. When credential vaulting, endpoint privilege elevation, cloud entitlement management, and session monitoring all report to the same system, the platform can reason about privilege holistically\u2014correlating a suspicious login with an escalated entitlement and a lateral movement attempt, without your analyst manually stitching together exports from separate tools.<\/p>\n

Pathfinder extends beyond the BeyondTrust portfolio through third-party connectors and integrations with identity providers, ITSM, and SIEM toolsets\u2014making it the focal point for your identity security defence-in-depth rather than another silo. BeyondTrust was recognised as an Overall Leader in the\u00a02026 KuppingerCole Leadership Compass for Privileged Access Management<\/a>\u00a0<\/strong>for the sixth consecutive year.<\/p>\n

See Your Own Blind Spots<\/strong><\/h2>\n

Most organisations are surprised by what a Paths to Privilege\"\u2122\" analysis uncovers\u2014shadow admins, stale service accounts, and indirect escalation routes that no single tool had surfaced. <\/p>\n

BeyondTrust\u2019s Identity Security Risk Assessment (ISRA) maps your environment in days, not months, and delivers a prioritised view of your identity attack surface.\u00a0Start your free ISRA \u2192<\/strong><\/a><\/code><\/pre>\n
How Pathfinder Works: Visibility, Intelligence, Protection<\/strong><\/h2>\n
Visibility: Mapping Every Path to Privilege\"\u2122\"<\/strong><\/p>\n
Pathfinder\u2019s\u00a0Identity Security Insights\u00ae<\/a>\u00a0<\/strong>layer continuously discovers and correlates every identity\u2014human, machine, workload, and AI agent\u2014across your endpoints, servers, clouds, SaaS applications, and databases. Its True Privilege Graph\"\u2122\" renders a live map of effective access: not just direct role assignments, but the indirect and hidden privilege paths that static, role-based reviews routinely miss.<\/p>\n
\"\"<\/figure>\n
Built-in risk ratings and actionable recommendations turn that map into a prioritised worklist, while real-time detection of anomalous activity keeps the picture current as your environment changes. AI agents are treated as first-class identities\u2014discovered, mapped, and governed with the same rigour as human administrators.<\/p>\n
Intelligence: AI That Prioritises and Investigates<\/strong><\/h2>\n
Visibility without prioritisation buries your team in findings. Pathfinder\u2019s intelligence layer analyses privilege patterns, entitlement drift, access behaviours, and active attack indicators\u2014then surfaces the detections that matter most, such as a newly created shadow admin or an internet-exposed AI agent holding high privileges.<\/p>\n
With\u00a0PathfinderAI<\/a>\u00a0<\/strong>(early access, April 2026), your analysts can query the platform in natural language\u2014\u201cWhich Azure accounts hold elevated privileges without MFA?\u201d<\/em>\u2014and receive contextually grounded answers in seconds. For enterprises standardising on their own AI stack, the Pathfinder MCP Server exposes these capabilities to Microsoft Copilot, ServiceNow, OpenAI, and Anthropic through the open Model Context Protocol. Governance is built in: LLM features are disabled by default, require explicit opt-in, and inherit Pathfinder\u2019s role-based access controls.<\/p>\n
Protection: Turning Insight into Enforcement<\/strong><\/h2>\n
This is where Pathfinder separates from visibility-only tooling: everything the platform sees, it can act on\u2014from the same console.<\/p>\n