Risk-Driven Approach to IAM

This guide outlines the most crucial IAM risks every organisation must address, based on proven practices from leading European security teams. The selected risks meet compliance standards like DORA, ISO 27001, and NIS 2.

✅ Top 12 IAM risks by category
✅ Build your own Risk Matrix
✅ Based on ISO 27001 & NIS 2
✅ For CISOs and Compliance Teams

From Reactive to Proactive IAM

Modern IAM programmes face growing pressure to reduce risk, ensure compliance, and support operational efficiency. Yet many organisations still lack a clear structure to identify and prioritise identity-related risks.

This guide introduces a risk-driven approach to IAM, based on proven practices from leading European organisations. It outlines the most critical risks and maps them to four categories, helping organisations move from reactive IAM to proactive risk management.

The Four Categories of IAM Risk

Security Risks

Security risks refer to identity-related exposures that can be exploited to gain unauthorised access, escalate privileges, or compromise systems and data. These risks expand the attack surface and are often targeted in both external breaches and insider threats.

Compliance Risks

Compliance risks arise when IAM processes fail to meet regulatory, legal, or internal policy requirements. These risks affect audit readiness, increase legal exposure, and can lead to sanctions under standards such as NIS 2, ISO 27001, or GDPR.

Operational Risks

These risks affect the effectiveness and scalability of IAM operations. They result in delays, administrative burden, and increased potential for human error — hindering the ability to manage access efficiently at scale.

Data Quality Risks

Data quality risks occur when identity data is inaccurate, incomplete, or inconsistent across systems. Poor data leads to flawed access decisions, failed automation, and unreliable reporting — undermining IAM governance.

The Top 12 IAM Risks

1. Orphaned Accounts

Accounts with no active owner form an interesting path for hackers to gain access to organisation resources. Key indicators include accounts that haven't been used for 90+ days, accounts that have never been logged into, and accounts with no correlated HR record. Eliminating leftover accounts tied to former employees is critical for reducing exposure.

2. Unmanaged Privileged Accounts

Privileged accounts give significant access to organisation resources and can change or disable security systems. When not properly managed, they pose a high security risk. These include standard admin accounts, stealthy accounts with administrative rights, service accounts, and non-personal accounts that are hard to monitor.

3. Excessive Permissions

The cumulated access rights of all users together determine the attack surface of your organisation. There is often a gap between granted and required access rights. The objective is to minimise access to only what is needed — following the principle of least privilege.

4. Separation of Duties Violations

Conflicting roles — "toxic combinations" — allow users to bypass critical controls, increasing the risk of fraud and regulatory non-compliance. Undetected toxic combinations and incomplete SoD coverage weaken auditability and governance.

5. Internal Policy Violations

Organisations often define internal IAM policies — such as mandatory training, certification, or background checks — linked to access rights for specific systems or roles. Failure to enforce these policies results in access being granted without proper validation, increasing compliance exposure.

6. Missing Access Reviews

Access reviews are periodic evaluations of who has access to what, and whether that access is still appropriate. Failure to regularly review and certify user access can result in outdated or unauthorised access going unnoticed. Most compliance frameworks require periodic access reviews for critical systems.

7. Joiner-Mover-Leaver (JML) Gaps

JML processes manage user access throughout their lifecycle. If access is not updated or removed during lifecycle events — a role change or a departure — organisations face increased risks of unauthorised access and non-compliance. A former contractor still having active credentials after their engagement ends is a common example.

8. Missing Ownership

Each role, entitlement, or application should have a clearly assigned owner responsible for reviewing and managing its access. Without ownership, access rights become outdated and unreviewed, leading to audit gaps and ineffective governance.

9. Account Clutter

Accounts that are not orphaned but are just as unnecessary make identity management less manageable. Applying good hygiene to users helps prevent risks and contributes to a more structured, efficient environment.

10. Role Clutter

Roles that are no longer necessary only make role management more cumbersome. Role proliferation leads to declining operational efficiency and increases the chance of assigning users an outdated or incorrect role.

11. Incomplete Offboarding

If offboarding is delayed or incomplete, former users may retain access to systems, increasing the risk of security breaches. It also leads to unnecessary licence costs and compliance issues.

12. Data Quality Issues

Inaccurate or incomplete identity data undermines every aspect of IAM. It leads to incorrect access rights, missed policy violations, failed automation, and unreliable audit reporting. If the HR system is not updated when an employee changes departments, their access will never be reviewed correctly.