Identity & Access Management: Top 10 Common Mistakes

Critical IAM Failures Attackers Exploit

CyberCQR Top 10 | January 2026 | 5 minutes reading time

The Cost of IAM Failures

Stolen credentials were the most common way in, at 22% of breaches in Verizon's 2025 Data Breach Investigations Report. Organisations that avoid these 10 common mistakes sharply reduce identity-based breaches. Those that don't face a global average breach cost of $4.4M (IBM, 2025) and often-preventable regulatory penalties.

❌ Mistake #1: Treating MFA as "Optional" or "High-Risk Users Only"

The Error: "We require MFA for admins but not regular users because it's too inconvenient." Or exempting executives from MFA because "they're too busy."

Why It's Dangerous:

• Attackers target non-MFA accounts first—these are easiest entry points
• Single compromised regular account enables lateral movement to privileged access
• Executives are prime targets - exempting them is catastrophic
• Partial MFA deployment provides false sense of security

❌ Mistake #2: Relying on SMS/Phone-Based MFA for Sensitive Systems

The Error: "We have MFA enabled - we send codes via SMS." Used for accessing sensitive systems like email, cloud infrastructure, or financial systems.

Why It's Dangerous:

• SMS vulnerable to SIM swapping attacks (successful in minutes)
• Phone-based MFA susceptible to social engineering and MFA fatigue attacks
• NIST deprecated SMS-based MFA for high-value accounts
• Attackers routinely bypass SMS MFA - it's no longer considered secure

❌ Mistake #3: Granting Permanent Administrative Privileges

The Error: IT staff, developers, and power users have permanent admin rights. "It's inconvenient to request elevated access every time."

Why It's Dangerous:

• An attacker with an admin account can switch off defences and reach everything
• Permanent admin rights mean malware runs with admin privileges
• No audit trail of why elevated access was used
• Violates least privilege and Just-in-Time (JIT) access principles

❌ Mistake #4: Failing to Deprovision Access When Employees Leave

The Error: Former employee accounts remain active for days, weeks, or months after departure. "We'll disable them eventually when IT gets around to it."

Why It's Dangerous:

• Accounts for former employees often stay active long after they leave
• Disgruntled former employees may access systems maliciously
• Attackers target former employee credentials (often not monitored)
• Violates compliance requirements and audit findings

❌ Mistake #5: Allowing Weak or Reused Passwords

The Error: "Password123!" meets complexity requirements. Users recycle same password across work and personal accounts.

Why It's Dangerous:

• Complexity requirements don't prevent weak passwords - users predictably modify: "Password123"
• Password reuse means personal account breach compromises work accounts
• Credential stuffing attacks test billions of leaked credentials against corporate systems
• Even "strong" passwords <15 characters can be brute-forced

❌ Mistake #6: No Monitoring or Alerting on Identity Anomalies

The Error: "We have identity systems but don't monitor them." No alerts for impossible travel, unusual access patterns, or privilege escalation.

Why It's Dangerous:

• Compromised accounts operate undetected for 200+ days on average
• Attackers test credentials, escalate privileges, move laterally - all invisible
• By time breach is discovered, attackers have exfiltrated sensitive data
• No forensic evidence to understand attack timeline or scope

❌ Mistake #7: Mixing Business and Personal Identities

The Error: Executives use personal email for business. Same LinkedIn account for personal networking and executive role. Board members post company information on personal social media.

Why It's Dangerous:

• Personal accounts lack enterprise security controls (no MFA, monitoring, DLP)
• Personal email breach exposes business communications and sensitive data
• Social engineering attacks target personal accounts to gain business access
• Compliance violations when business data flows through personal systems

❌ Mistake #8: Ignoring Service Accounts and Non-Human Identities

The Error: "We secure user accounts but service accounts don't need MFA - they're just automation." Hard-coded credentials in scripts and applications.

Why It's Dangerous:

• Service accounts often have elevated privileges and never-expiring passwords
• Hard-coded credentials in code repositories discovered by attackers
• No monitoring of service account usage - abuse goes undetected
• SolarWinds breach exploited compromised service account credentials

❌ Mistake #9: No Regular Access Reviews or Privilege Cleanup

The Error: "We grant access when needed but never review whether it's still required." Employees accumulate permissions as they change roles.

Why It's Dangerous:

• Privilege creep: users build up far more access than their role needs
• Former project access remains active indefinitely
• No one knows who actually has access to sensitive systems
• Compromised account has excessive access enabling widespread damage

❌ Mistake #10: Trusting Federation Without Validation

The Error: "We trust any identity from our federated partners." No validation of identity provider security posture or monitoring of federated access.

Why It's Dangerous:

• Compromised partner IdP grants attackers access to your systems
• Supply chain attacks exploit weak federation security
• No visibility into how partner authenticates users
• Federation misconfiguration creates backdoor access

Combined Impact: Organisations making multiple IAM mistakes face compounding breach costs. A single incident that exploits three or four of these mistakes costs far more than any one of them alone.

Attackers exploit these mistakes every day.

Organisations that fix all 10 sharply reduce identity-based breaches and close the most common attack vectors used by ransomware groups and nation-state actors.

About CyberCQR

CyberCQR provides strategic cybersecurity advisory services including Identity & Access Management gap assessments, Zero Trust architecture reviews, and remediation roadmaps that help organisations eliminate these common mistakes.

Document ID: IDENTITY-TOP10-002 | Version: 1.0 | Date: 06 January 2026 | Series: Top 10 for Identity & Access