Privileged access, not a distracted employee clicking the wrong link, is now the expensive part of most security programmes. Every awareness programme is still built around the old message, and the data no longer supports it.
The Credential Was Already Valid
The 2026 Verizon Data Breach Investigations Report, which analysed more than 22,000 confirmed breaches across 145 countries between November 2024 and October 2025, found stolen credentials present in 39 per cent of all breaches and remaining the primary method attackers use to move laterally once inside. Credential abuse specifically for initial access rose to 31 per cent, up 55 per cent year on year. Internal actors, employees and contractors using access they were already issued, appeared in 12 per cent of breaches, down from 18 per cent the year before. The headline number is falling. The mechanism behind it, someone already holding a valid credential, is not.
Most of It Isn’t Malicious
The same report found that when internal actors were involved, 60 per cent of the misuse was driven by convenience, the example Verizon gives is an employee emailing company files to a personal account, not sabotage or theft. Financial gain accounted for 33 per cent. The badge-and-job-title problem in most security programmes is rarely a disgruntled employee planning something. It is someone doing their job in the easiest available way, using access nobody has revisited since the day it was granted.
Privileged Access Is the Expensive Kind to Fix
IBM’s 2026 Cost of a Data Breach report, based on 602 organisations that experienced a breach between March 2025 and February 2026 across 16 countries, put the global average breach cost at $4.99 million, up 12 per cent year on year, and found the mean time to identify and contain a breach rose to 247 days, reversing five straight years of improvement. Coverage of the report’s attack-vector breakdown put valid account abuse specifically at $5.07 million on average, taking 179 days to identify and a further 64 to contain. That is slower than almost anything else in the report, because nothing about a valid login looks like an attack until the damage is already done. The same report found AI-enabled breaches, still a minority of the total but growing fast, cost even more: $6 million on average, and now account for one in four malicious breaches, up 56 per cent on the year before. A stolen or misused credential is frequently the thing that lets an AI-enabled attack look legitimate once it is inside.
A Governance Problem Wearing a Technology Budget
Most security spending is built to keep people who were never supposed to have access out. Firewalls, endpoint detection, phishing simulations, all of it assumes the threat is external. Far less of it is built to keep track of what happens to access after it has been legitimately granted, when someone changes role, when a contract ends, when a project a person was staffed on finishes and nobody remembers to remove the permissions that came with it. Unrevoked access is a governance problem that happens to be wearing a security team’s budget, the same mismatch between where the money goes and where the risk actually sits that explains why the security spending that is working exactly as intended is so often the first thing to get cut.
What Actually Closes the Gap
Access reviews built around the calendar, an annual audit, a quarterly certification, catch what has already accumulated. They do not catch it quickly. Tying access removal to the event that actually changes what someone needs, a role change, a contract end, a project closing, closes the gap between when access stops being necessary and when it stops existing. Naming an owner for that review who is not the same person provisioning the access in the first place removes the conflict of interest that lets standing privilege quietly persist. And treating every credential with elevated access as something that expires by default, rather than something that has to be actively noticed and revoked, changes the default from trust to verification.
The Question Worth Asking Before the Next Access Review
Most security leaders would say the weakest link is whoever might click the wrong email. The harder question is whether anyone can say, right now, exactly who holds privileged access across the organisation, why they still need it, and when it was last checked. Most cannot answer that with a number, and that gap is where the next expensive breach is already sitting.