Identity & Access Management: Top 10 Common Mistakes

Critical IAM Failures That Enable 80% of Breaches

CyberCQR Top 10 | January 2026 | 5 minutes reading time

The Cost of IAM Failures

80% of breaches involve compromised credentials. Organisations that avoid these 10 common mistakes sharply reduce identity-based breaches. Those that don't face average breach costs of $4.5M and often-preventable regulatory penalties.

❌ Mistake #1: Treating MFA as "Optional" or "High-Risk Users Only"

The Error: "We require MFA for admins but not regular users because it's too inconvenient." Or exempting executives from MFA because "they're too busy."

Why It's Dangerous:

• Attackers target non-MFA accounts first—these are easiest entry points
• Single compromised regular account enables lateral movement to privileged access
• Executives are prime targets (12x more targeted) - exempting them is catastrophic
• Partial MFA deployment provides false sense of security

❌ Mistake #2: Relying on SMS/Phone-Based MFA for Sensitive Systems

The Error: "We have MFA enabled - we send codes via SMS." Used for accessing sensitive systems like email, cloud infrastructure, or financial systems.

Why It's Dangerous:

• SMS vulnerable to SIM swapping attacks (successful in minutes)
• Phone-based MFA susceptible to social engineering and MFA fatigue attacks
• NIST deprecated SMS-based MFA for high-value accounts
• Attackers routinely bypass SMS MFA - it's no longer considered secure

❌ Mistake #3: Granting Permanent Administrative Privileges

The Error: IT staff, developers, and power users have permanent admin rights. "It's inconvenient to request elevated access every time."

Why It's Dangerous:

• 80% of breaches involve privileged account compromise
• Permanent admin rights mean malware runs with admin privileges
• No audit trail of why elevated access was used
• Violates least privilege and Just-in-Time (JIT) access principles

❌ Mistake #4: Failing to Deprovision Access When Employees Leave

The Error: Former employee accounts remain active for days, weeks, or months after departure. "We'll disable them eventually when IT gets around to it."

Why It's Dangerous:

• 40% of organisations have active accounts for former employees
• Disgruntled former employees may access systems maliciously
• Attackers target former employee credentials (often not monitored)
• Violates compliance requirements and audit findings

❌ Mistake #5: Allowing Weak or Reused Passwords

The Error: "Password123!" meets complexity requirements. Users recycle same password across work and personal accounts.

Why It's Dangerous:

• Complexity requirements don't prevent weak passwords - users predictably modify: "Password123"
• Password reuse means personal account breach compromises work accounts
• Credential stuffing attacks test billions of leaked credentials against corporate systems
• Even "strong" passwords <15 characters can be brute-forced

❌ Mistake #6: No Monitoring or Alerting on Identity Anomalies

The Error: "We have identity systems but don't monitor them." No alerts for impossible travel, unusual access patterns, or privilege escalation.

Why It's Dangerous:

• Compromised accounts operate undetected for 200+ days on average
• Attackers test credentials, escalate privileges, move laterally - all invisible
• By time breach is discovered, attackers have exfiltrated sensitive data
• No forensic evidence to understand attack timeline or scope

❌ Mistake #7: Mixing Business and Personal Identities

The Error: Executives use personal email for business. Same LinkedIn account for personal networking and executive role. Board members post company information on personal social media.

Why It's Dangerous:

• Personal accounts lack enterprise security controls (no MFA, monitoring, DLP)
• Personal email breach exposes business communications and sensitive data
• Social engineering attacks target personal accounts to gain business access
• Compliance violations when business data flows through personal systems

❌ Mistake #8: Ignoring Service Accounts and Non-Human Identities

The Error: "We secure user accounts but service accounts don't need MFA - they're just automation." Hard-coded credentials in scripts and applications.

Why It's Dangerous:

• Service accounts often have elevated privileges and never-expiring passwords
• Hard-coded credentials in code repositories discovered by attackers
• No monitoring of service account usage - abuse goes undetected
• SolarWinds breach exploited compromised service account credentials

❌ Mistake #9: No Regular Access Reviews or Privilege Cleanup

The Error: "We grant access when needed but never review whether it's still required." Employees accumulate permissions as they change roles.

Why It's Dangerous:

• Privilege creep: users have 10-20x more access than needed
• Former project access remains active indefinitely
• No one knows who actually has access to sensitive systems
• Compromised account has excessive access enabling widespread damage

❌ Mistake #10: Trusting Federation Without Validation

The Error: "We trust any identity from our federated partners." No validation of identity provider security posture or monitoring of federated access.

Why It's Dangerous:

• Compromised partner IdP grants attackers access to your systems
• Supply chain attacks exploit weak federation security
• No visibility into how partner authenticates users
• Federation misconfiguration creates backdoor access

Combined Impact: Organisations making multiple IAM mistakes face compounding breach costs. A single incident exploiting 3-4 of these mistakes can exceed $20M.

80% of breaches exploit these IAM mistakes.

Organisations that fix all 10 sharply reduce identity-based breaches and close the most common attack vectors used by ransomware groups and nation-state actors.

About CyberCQR

CyberCQR provides strategic cybersecurity advisory services including Identity & Access Management gap assessments, Zero Trust architecture reviews, and remediation roadmaps that help organisations eliminate these common mistakes.

Document ID: IDENTITY-TOP10-002 | Version: 1.0 | Date: 06 January 2026 | Series: Top 10 for Identity & Access