What is the main risk identified in the study?

Credential theft due to inadequate IAM controls.

How can organizations mitigate this risk?

Implement zero-trust policies and enforce multi-factor authentication.

Identity Access Management Gaps Expose Credential Theft

The latest analysis from darkreading.com reveals that a significant portion of enterprises maintain identity and access management (IAM) systems that lack multi-factor authentication and rely on legacy protocols. The study quantifies the risk: attackers can harvest credentials through phishing, credential stuffing, or exploitation of weak password policies, then move laterally within the network.

Affected Products and Versions

The report focuses on common IAM platforms such as Microsoft Azure AD (pre-2023.5), Okta Identity Cloud (versions 4.0–4.2), and on-premise LDAP directories that have not applied the latest security patches. These systems expose user accounts to brute-force attacks when password policies are insufficient or when default configurations remain unchanged.

Attack Path and Exposure

Initial compromise – An attacker gains access to a user account via phishing or credential stuffing.
Privilege escalation – The compromised account is used to request elevated permissions through misconfigured role-based access controls.
Data exfiltration – With elevated privileges, the attacker accesses sensitive data or pivots to other systems.

The exposure is amplified when IAM systems are integrated with cloud services that automatically provision resources based on user roles. If those roles are granted excessive permissions, the attacker can create new cloud instances, deploy malicious code, or exfiltrate data without detection.

Evidence and Analysis

The study cites multiple incident reports where attackers leveraged weak IAM configurations to move laterally. One case involved an attacker who used a compromised Azure AD account to create a new service principal with administrative rights, then deployed ransomware across the tenant. Another example involved an Okta tenant where default password policies allowed users to set passwords shorter than eight characters, enabling brute-force attacks.

Mitigation Recommendations

Enforce multi-factor authentication (MFA) – Require MFA for all privileged accounts and for any account that can access critical resources.
Apply least-privilege principles – Review role assignments and remove unnecessary permissions.
Update and patch IAM systems – Ensure that all IAM platforms are running the latest security patches and that default configurations are hardened.
Implement zero-trust architecture – Treat every access request as untrusted, verify the identity and context of the request, and enforce continuous authentication.
Monitor for anomalous activity – Deploy user and entity behavior analytics (UEBA) to detect unusual login patterns or privilege escalation attempts.

Internal Reference

The analysis aligns with findings in the Third-Party AI Agents Slip Through Identity Controls, Exposing Enterprise Data report, which highlights similar IAM weaknesses in third-party integrations.

Conclusion

The evidence demonstrates that IAM systems lacking MFA and least-privilege controls remain a high-risk vector for credential theft and lateral movement. Immediate action to enforce MFA, patch legacy systems, and adopt zero-trust principles is essential to reduce exposure.

Related coverage

Explore more on this topic

More identity coverage

Identity Access Management Gaps Expose Organizations to Credential Theft