CyberCQR Top 10 · Identity and access
Identity and access management: ten common mistakes
The identity weaknesses attackers find most often, why each one matters, and how to fix it. Each mistake is the mirror of an action in our ten must-do actions.
Summary
The point for boards. Most identity breaches do not need clever attackers. They use the gaps organisations leave open: an account without MFA, an administrator who is always an administrator, a leaver whose account still works. Each mistake below is common, well understood and fixable, usually with tools the firm already owns.
The ten mistakes
1. Treating MFA as optional, or only for some people
The mistake. MFA for administrators but not for everyone else, or exemptions for executives because it is inconvenient.
Why it matters. Attackers look for the accounts without MFA. In the 2024 Snowflake attacks, around 165 organisations were notified after attackers signed in with stolen passwords on accounts that did not require MFA [6]. Microsoft found MFA reduced the risk of compromise by 99.22% [2].
The fix. MFA for every account, with no exceptions for seniority. Phishing-resistant methods for administrators and executives first.
2. Relying on text message codes for sensitive systems
The mistake. Treating SMS codes as good enough for email, cloud administration or finance systems.
Why it matters. Text message codes can be stolen through SIM swapping, and codes and app approvals can both be captured by fake sign-in pages. NIST treats SMS and voice codes as a restricted method [3], and CISA describes phishing-resistant MFA as the gold standard [4].
The fix. Move to passkeys, FIDO2 security keys or Windows Hello for Business, starting with administrators and sensitive systems. Use number matching for any remaining app approvals.
3. Giving people permanent administrator rights
The mistake. IT staff and power users who are administrators all the time, on the same account they use for email and browsing.
Why it matters. An attacker with an administrator account can switch off defences and reach everything, and malware that runs on that account runs with the same power. The NCSC advises separate administration accounts, used only for that purpose [9].
The fix. Standard accounts for everyday work, separate administrator accounts, and administrator rights granted only when needed and for a limited time.
4. Not removing access when people leave
The mistake. Accounts that stay active for days, weeks or months after someone leaves, especially in cloud services outside single sign-on.
Why it matters. A leaver's account still works, is rarely watched, and may be known to the former employee or anyone they shared it with. The NCSC's identity guidance calls for access to be removed promptly when it is no longer needed [8].
The fix. Let the HR system trigger account removal on the day someone leaves, and check regularly for accounts with no current owner.
5. Password rules that make passwords weaker
The mistake. Complexity rules and forced changes every 90 days, which lead to predictable passwords such as "Summer2026!", and the same password used at work and at home.
Why it matters. Attackers try leaked passwords from other breaches against business accounts. NIST no longer recommends complexity rules or forced regular changes, and asks for passwords to be checked against lists of breached ones; a password used on its own should be at least 15 characters [3]. The NCSC recommends three random words [10].
The fix. Longer passwords, a block list of breached and common passwords, MFA everywhere, and passwordless sign-in where possible.
6. Not watching sign-ins for warning signs
The mistake. Identity systems that log everything and alert on nothing.
Why it matters. The longer a stolen account goes unnoticed, the more an attacker can do with it. Mandiant's median time to detect an intrusion was 11 days in 2024 [7]; without identity monitoring, it can be much longer.
The fix. Alerts for password spraying, impossible travel, new MFA methods and unexpected admin role changes, and agreed authority to suspend an account straight away.
7. Mixing business and personal identities
The mistake. Executives using personal email or messaging for business, or personal accounts linked to business ones.
Why it matters. Personal accounts sit outside the organisation's controls, and they are a favourite route for impersonation and payment fraud. Business email compromise cost close to $2.8 billion in 2024 in reports to the FBI alone [11].
The fix. Keep business and personal accounts completely separate, give senior staff managed devices, and require an independent check before any change to payment details.
8. Forgetting service, test and other non-human accounts
The mistake. Securing staff accounts while service accounts, test accounts and application credentials are left with old passwords, broad rights and nobody watching.
Why it matters. In 2024 attackers broke into Microsoft's corporate email after a password-spraying attack on a legacy, non-production test account [12]. Credentials written into scripts and code are another common way in.
The fix. An inventory of non-human and test accounts with named owners, secrets kept in a vault such as Azure Key Vault or HashiCorp Vault, automatic rotation, and monitoring of how these accounts are used.
9. Never reviewing who has access to what
The mistake. Access granted when needed and never taken away, so people collect permissions as they change roles.
Why it matters. Every unused permission is something an attacker can use once an account is taken, and nobody can say for certain who can reach the most sensitive systems. The NCSC puts least privilege at the centre of identity management [8].
The fix. Access through defined roles, managers confirming their team's access at least every quarter, and removal of access that has not been used.
10. Trusting federation and identity infrastructure without checking it
The mistake. Accepting sign-ins from partners and federated systems without checking how they are secured, and treating federation servers as just another server.
Why it matters. Whoever controls the identity system controls access. In the SolarWinds campaign, CISA reported attackers moving into Microsoft cloud services by forging authentication tokens and adding credentials to applications [13].
The fix. Treat identity servers as the most sensitive systems you run, review which partners can sign in and how, apply conditional access to external identities, and monitor changes to applications and federation settings.
How the mistakes add up
| Mistake | Typical route to harm | Impact |
|---|---|---|
| No MFA or weak MFA | Phishing or a leaked password leads to account takeover, then data theft | Data theft and notification costs |
| Permanent administrator rights | Malware runs with administrator rights, then ransomware spreads | Systems locked and data stolen |
| Leavers not removed | A former employee's account is used to take data | Loss of data and intellectual property |
| Password reuse | Leaked passwords from other sites work on business accounts | Many accounts taken over at once |
| No identity monitoring | An attacker works unnoticed | Damage grows the longer it goes unseen |
| Business and personal mixed | A personal account leads to business email, then payment fraud | Fraudulent payments |
Table 1. A single incident that exploits several of these mistakes costs far more than any one of them alone.
Five questions for your next board meeting
- Which of these ten mistakes would an independent review find here today?
- Who has an MFA exception, and who approved it?
- How many service and test accounts do we have, and who owns each one?
- How quickly would we notice a senior person's account being used by someone else?
- When did we last review who can reach our most sensitive systems?
Glossary
| Term | Meaning |
|---|---|
| Federation | Trusting another identity system, such as a partner's, to sign people in to your services. |
| Multi-factor authentication (MFA) | Signing in with something beyond a password, such as an app prompt or a security key. |
| Non-human account | An account used by software, such as a service account or an application's credentials, rather than a person. |
| Password spraying | Trying a few common passwords against many accounts, to avoid lockouts. |
| Phishing-resistant MFA | Methods, such as passkeys and FIDO2 security keys, that a fake website cannot capture and reuse. |
| SIM swapping | Persuading a mobile network to move someone's number to a new SIM, so the attacker receives their text messages. |
Table 2. Terms used on this page (alphabetical).
Further reading
From CyberCQR
- Identity and Access Management: Ten Must-Do Actions. The positive side of this list, in the order to tackle it.
- Secure mobilisation at scale. Our case study on moving tens of thousands of users to cloud identity and Zero Trust access.
- Temporary and Test Account Strategy for Entra ID. Mistake 8 in depth.
References
- [1]Verizon, 2025 Data Breach Investigations Report, April 2025.
https://www.verizon.com/business/resources/reports/dbir/ - [2]Microsoft Research (Meyer and others), How effective is multifactor authentication at deterring cyberattacks?, May 2023.
https://www.microsoft.com/research/publication/how-effective-is-multifactor-authentication-at-deterring-cyberattacks/ - [3]National Institute of Standards and Technology, SP 800-63B-4: Digital Identity Guidelines, Authentication and Authenticator Management, 2025.
https://pages.nist.gov/800-63-4/sp800-63b.html - [4]Cybersecurity and Infrastructure Security Agency, Implementing phishing-resistant MFA, October 2022.
https://www.cisa.gov/sites/default/files/publications/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf - [5]Department for Science, Innovation and Technology and Home Office, Cyber Security Breaches Survey 2025/2026, 30 April 2026.
https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026 - [6]TechTarget, Mandiant: 'Exposed credentials' led to Snowflake attacks, June 2024.
https://www.techtarget.com/cybersecurity/news/366588655/Mandiant-Exposed-credentials-led-to-Snowflake-attacks - [7]Mandiant (Google Cloud), M-Trends 2025, 23 April 2025.
https://cloud.google.com/blog/topics/threat-intelligence/m-trends-2025/ - [8]National Cyber Security Centre, 10 Steps to Cyber Security: identity and access management.
https://www.ncsc.gov.uk/collection/10-steps/identity-and-access-management - [9]National Cyber Security Centre, Secure system administration.
https://www.ncsc.gov.uk/collection/secure-system-administration - [10]National Cyber Security Centre, Top tips for staying secure online: three random words.
https://www.ncsc.gov.uk/collection/top-tips-for-staying-secure-online/three-random-words - [11]Nacha, FBI's IC3 finds almost $8.5 billion lost to business email compromise in last three years, April 2025.
https://www.nacha.org/news/fbis-ic3-finds-almost-85-billion-lost-business-email-compromise-last-three-years - [12]Microsoft, Form 8-K filing on the Midnight Blizzard attack, January 2024.
https://www.sec.gov/Archives/edgar/data/789019/000119312524011295/d708866dex991.htm - [13]Cybersecurity and Infrastructure Security Agency, AA21-008A: Detecting post-compromise threat activity in Microsoft cloud environments, January 2021.
https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-008a
Security is the outcome, not a solution.
CyberCQR is a UK cyber security advisory practice. We help organisations find and fix identity weaknesses using the Microsoft licences they already own, without vendor commissions or product resale.