The whistleblower alleged that same team was delayed in responding to a mass shooting at Brown University in Rhode Island over Patel’s guidance and placing a jet on hold. The team instead drove from Quantico, Virginia – where the bureau’s headquarters is located – to Providence, Rhode Island, Durbin said.
Most identity programs still prioritize work the way they prioritize IT tickets: by volume, loudness, or “what failed a control check.” That approach breaks the moment your environment stops being mostly-human and mostly-onboarded.
In modern enterprises, identity risk is created by a compound of factors: control posture, hygiene, business context, and intent. Any one of these can perhaps be manageable on its own. The real danger is the toxic combination, when multiple weaknesses align and attackers get a clean chain from entry to impact.
A useful prioritization framework treats identity risk as contextual exposure, not configuration completeness.
Controls posture answers a simple question: If something goes wrong, will we prevent it, detect it, and prove it?
In classic IAM programs, controls are assessed as “configured / not configured.” But prioritization needs more nuance: a missing control is a risk amplifier whose severity depends on what identity it protects, what the identity can do and what other controls may be in place downstream.
Key control categories that directly shape exposure:
Prioritization lens – missing controls don’t matter equally everywhere. Missing MFA on a low-impact identity is not the same as missing MFA on a privileged identity tied to business critical systems. Controls posture must be evaluated in context.
Top Identity Security Gaps to Find and Close
A practical checklist to help you assess your application estate and improve your organization’s identity security posture by:
Hygiene is not about tidiness; it’s about ownership, lifecycle, and intent. Hygiene answers: Who owns this identity? Why does it exist? Is it still necessary?
The most common hygiene conditions that create systemic exposure:
Prioritization lens – Hygiene issues are the raw material of breaches. Attackers prefer neglected identities because they are less protected, less monitored, and more likely to retain excess privileges.
Security teams often prioritize based on technical severity alone. That’s incomplete. Business context asks: If compromised, what breaks?
Business context includes:
Prioritization lens – Identity risk is not only “can an attacker get in,” but “what happens if they do.” High-severity exposure in low-impact systems should not outrank moderate exposure in mission-critical systems.
Identity decisions are often made without answering: What is this identity trying to do right now, and is that aligned with its purpose?
Intent becomes critical with:
Signals that help infer intent include:
Prioritization lens – A weakly controlled identity with active, anomalous intent should jump the queue, because it’s not just vulnerable, it may be in use now.
The biggest prioritization mistake is treating issues as additive. Real-world identity incidents are multiplicative: attackers chain weaknesses. Risk escalates nonlinearly when controls gaps, poor hygiene, high impact, and suspicious intent align.
Examples of toxic combinations that should be treated as “drop everything”:
This is the heart of identity prioritization: the toxic combination defines risk, not any single finding in isolation.
When you’re deciding what to fix first, ask four questions:
Then prioritize work that yields the most risk reduction, not the most checkbox closure:
Identity risk isn’t a list, it’s a graph of trust paths plus context. Controls posture, hygiene, business context, and intent are each important alone, but the danger comes from their alignment. If you build prioritization around toxic combinations, you stop chasing volume and start reducing real-world breach likelihood and audit exposure.
Orchid passively discovers the entire application estate managed or unmanaged and identities via telemetry, builds an identity graph, and converts posture signals + hygiene + business context + activity into contextual risk scores. It ranks the toxic combinations that matter most, via dynamic Severity produces a sequenced remediation plan, and then drives no-code onboarding into governance (managed identities/IGA policies) with continuous monitoring, so teams reduce real exposure fast, not just close the most findings.
Friedrich Merz said it would be a mistake to “decouple” Germany from China shortly before boarding a plane to Beijing.
Source link