Companies are multiplying the access points to their systems without always having a clear understanding of who can use them. Every employee, supplier, application, or automated process needs a digital identity to operate. The problem arises when these permissions remain active, accumulate over time, or allow operations that no longer correspond to their original purpose. In Mexico and across Latin America, where the digitalization of financial, industrial, and public services is advancing rapidly, this situation poses a growing risk: an attacker can compromise an organization using legitimate credentials, without having to directly breach its technological defenses.For years, much of the investment in cybersecurity focused on preventing attackers from entering corporate networks. Firewalls, antivirus software, and threat detection systems were part of a strategy designed to protect the perimeter. This approach remains necessary, but it is insufficient for organizations whose systems operate in the cloud, exchange information with third parties, and execute processes without human intervention.Digital identity has become one of the primary mechanisms for determining who can access information and what operations they are authorized to perform. It also presents an opportunity for cybercriminals: obtaining valid credentials can facilitate access to internal systems and enable subsequent movements that are difficult to distinguish from everyday activity.This shift has given rise to an underground market for access. Passwords, credentials, authentication tokens, and previously compromised access are bought and sold in this market. Buyers can use them to commit financial fraud, extract information, extort organizations, or deploy ransomware, a type of attack that locks systems or information to demand payment.The implication is significant: a company may have robust controls against malicious software and still remain exposed if an attacker manages to operate with the permissions of a legitimate user.The Growth of Identities No One SeesOne of the greatest challenges lies in so-called non-human identities. These are credentials assigned to applications, services, application programming interfaces (APIs), and automated processes that need to communicate with one another to perform operations.Consider a financial institution. One application may retrieve customer information, another may validate transactions, and a third may exchange data with suppliers. Every interaction requires authorization. Something similar occurs in an industrial plant, where different systems exchange information to monitor production, manage inventories, or schedule maintenance.These identities allow companies to operate faster and with less manual intervention. However, they can also become vulnerable access points when their credentials remain active indefinitely, are shared across applications, or retain more permissions than necessary.Unlike employees, whose onboarding and departure are typically linked to human resources processes, application and service identities can be created by different technology departments without going through a centralized authorization and review mechanism.This creates a structural weakness. An organization may know precisely how many people work for it while lacking a complete inventory of the technical accounts that have access to its critical systems.The introduction of artificial intelligence and new autonomous processes adds further complexity. When a system can retrieve information, connect to other applications, or execute specific tasks, its permissions need explicit limits. Automation expands operational capabilities, but it can also increase the consequences of compromised credentials.When Authorization Becomes a ThreatThe risk takes on another dimension when an identity has elevated privileges. Administrative accounts, for example, can modify configurations, create users, or access sensitive information. If an attacker gains control of one of these accounts, the incident can spread to systems beyond the one initially compromised.This movement, known as lateral movement, explains why some attacks manage to affect multiple areas of an organization after gaining initial access.In financial services, compromised credentials can facilitate fraudulent transactions or expose customer information. In manufacturing, unauthorized access to management systems can disrupt processes and affect the supply chain. In the energy sector, where administrative platforms coexist with technologies that support operations, the potential consequences require particular attention to access separation and monitoring.Public institutions face an additional challenge due to the volume and sensitivity of the data they manage, including personal records and, in certain services, biometric information.For Mexico, this issue is particularly relevant given the growing integration of digital services, technology providers, and platforms that share information. Every connection introduces an operational dependency and requires clear accountability for the access granted.The most common mistake is assuming that legitimate credentials are equivalent to trustworthy activity. Authorization demonstrates that an identity has permission to perform certain actions, but it does not guarantee that the person using it is the original account holder or that their behavior is appropriate.Therefore, verifying identity at login is only one part of protection. It is also necessary to monitor how that access is used throughout the entire session.Cybersecurity Needs Governance, Not Just TechnologyThe corporate response begins with a decision that may seem administrative but has direct consequences for risk exposure: establishing who can authorize access, under what conditions, for how long, and who is responsible for revoking it.This model is known as Identity Governance and Administration (IGA). Its purpose is to maintain continuous control over the credential lifecycle, from creation to revocation.In practice, this involves periodically reviewing permissions, separating incompatible duties, and identifying accounts that remain active without an accountable owner or operational justification. It also requires coordination among human resources, technology, security, and the business units responsible for the processes involved.A second dimension involves managing privileged access through Privileged Access Management (PAM). The principle is straightforward: a person or application should have only the permissions strictly necessary and retain them only for as long as required.For example, a supplier responsible for updating an industrial system could receive temporary authorization to perform a specific task. Once the task is completed, access should be revoked. Keeping it open for operational convenience creates exposure that can persist for months.The third dimension is detecting and responding to the misuse of identities, even when an attacker has already bypassed initial authentication mechanisms. Identity Threat Detection and Response (ITDR) capabilities make it possible to identify anomalous behavior, privilege escalation, and movement between systems that could indicate an intrusion.These capabilities complement one another. Governance establishes the rules, privileged access management limits what can be done, and detection helps identify when an identity is being used inappropriately.Their effectiveness depends on integrating them into business processes. Purchasing isolated tools, without clearly defined responsibilities or criteria for granting and revoking permissions, is unlikely to resolve the underlying weaknesses.A Responsibility That Must Reach Executive LeadershipIdentity management is often treated as a specialized activity within the technology department. However, the decisions that determine its effectiveness involve the entire organization.A chief operating officer needs to know which third-party access permissions could affect the continuity of operations. A chief financial officer must understand which permissions allow transactions to be executed and authorized. Human resources must ensure that changes in employee roles or departures are promptly reflected in the systems. And senior management needs visibility into the risks posed by identities with elevated privileges.Based on our experience at IndraMind Cybersecurity, Indra Group’s cybersecurity business unit, one of the challenges is precisely to incorporate the protection of human and non-human identities into an ongoing governance, monitoring, and response model, rather than addressing it through independent technology projects.This also requires changing how cybersecurity maturity is assessed. Having multifactor authentication, for example, is an important measure, but it does not, by itself, prevent the misuse of valid credentials or the accumulation of permissions.Companies need to know how many identities have access to their critical assets, which ones retain elevated privileges, who is accountable for them, and what capabilities exist to detect and stop anomalous activity.The fundamental question is no longer limited to whether an organization can prevent an attacker from gaining access. It must also determine how much damage someone using an authorized identity could cause.As automation, connected services, and artificial intelligence continue to expand, the number of access permissions a company needs to manage will keep growing. The ability to govern them will become part of its operational resilience.The true measure of control will be ensuring that every identity, human or automated, has a known purpose, justified permissions, and a defined validity period. When a company cannot answer who has access to its systems, it cannot be certain that it still controls them.{“path”:{“baseUrl”:”\/”,”scriptPath”:null,”pathPrefix”:””,”currentPath”:”node\/65957″,”currentPathIsAdmin”:false,”isFront”:false,”currentLanguage”:”en”},”pluralDelimiter”:”\u0003″,”suppressDeprecationErrors”:true,”sharebardata”:{“buttons”:”\u003Cul class=\u0022social-sharebar\u0022\u003E\u003Cli\u003E\u003Cscript src=\u0022\/\/platform.linkedin.com\/in.js\u0022 type=\u0022text\/javascript\u0022\u003E\r\n lang: en_US\u003C\/script\u003E\u003Cscript type=\u0022IN\/Share\u0022 data-url=\u0022https:\/\/mexicobusiness.news\/cybersecurity\/news\/non-human-digital-identities-new-cybersecurity-threat\u0022 data-counter=\u0022top\u0022\u003E\u003C\/script\u003E\u003C\/li\u003E\u003Cli\u003E\r\n\u003Cdiv class=\u0022g-plusone\u0022 data-size=\u0022tall\u0022 data-href=\u0022https:\/\/mexicobusiness.news\/cybersecurity\/news\/non-human-digital-identities-new-cybersecurity-threat\u0022\u003E\u003C\/div\u003E\r\n\u003Cscript type=\u0022text\/javascript\u0022\u003E(function() {var po = document.createElement(\u0027script\u0027); po.type = \u0027text\/javascript\u0027; po.async = true;po.src = \u0027https:\/\/apis.google.com\/js\/plusone.js\u0027;var s = document.getElementsByTagName(\u0027script\u0027)[0]; s.parentNode.insertBefore(po, s);})();\u003C\/script\u003E\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022http:\/\/twitter.com\/share\u0022 class=\u0022twitter-share-button\u0022 data-url=\u0022https:\/\/mexicobusiness.news\/cybersecurity\/news\/non-human-digital-identities-new-cybersecurity-threat\u0022 data-count=\u0022vertical\u0022 data-via=\u0022Non-Human Digital Identities: The New Cybersecurity Threat\u0022\u003ETweet\u003C\/a\u003E\u003Cscript type=\u0022text\/javascript\u0022 src=\u0022http:\/\/platform.twitter.com\/widgets.js\u0022\u003E\u003C\/script\u003E\u003C\/li\u003E\u003Cli\u003E\u003Cdiv id=\u0022fb-root\u0022\u003E\u003C\/div\u003E \u003Cscript\u003E(function(d, s, id) { var js, fjs = d.getElementsByTagName(s)[0]; if (d.getElementById(id)) return; js = d.createElement(s); js.id = id; js.src = \u0022\/\/connect.facebook.net\/en_US\/all.js#xfbml=1\u0022; fjs.parentNode.insertBefore(js, fjs); }(document, \u0027script\u0027, \u0027facebook-jssdk\u0027));\u003C\/script\u003E \u003Chtml fb=\u0022http:\/\/ogp.me\/ns\/fb#\u0022\u003E\r\n\u003Cdiv class=\u0022fb-like\u0022 data-href=\u0022https:\/\/mexicobusiness.news\/cybersecurity\/news\/non-human-digital-identities-new-cybersecurity-threat\u0022 data-layout=\u0022box_count\u0022 data-action=\u0022like\u0022 data-size=\u0022small\u0022 data-show-faces=\u0022true\u0022 data-share=\u0022true\u0022\u003E\u003C\/div\u003E\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022mailto:?subject=https:\/\/mexicobusiness.news\/cybersecurity\/news\/non-human-digital-identities-new-cybersecurity-threat\u0022 class=\u0022sharebar-button email\u0022\u003EEmail\u003C\/a\u003E\u003C\/li\u003E\u003C\/ul\u003E”,”buttons_small”:”\u003Cul class=\u0022mobile-social-sharebar\u0022\u003E\u003Cli\u003E\u003Cscript src=\u0022\/\/platform.linkedin.com\/in.js\u0022 type=\u0022text\/javascript\u0022\u003E\r\n lang: en_US\u003C\/script\u003E\u003Cscript type=\u0022IN\/Share\u0022 data-url=\u0022https:\/\/mexicobusiness.news\/cybersecurity\/news\/non-human-digital-identities-new-cybersecurity-threat\u0022 data-counter=\u0022right\u0022\u003E\u003C\/script\u003E\u003C\/li\u003E\u003Cli\u003E\u003Cdiv class=\u0022g-plusone\u0022 data-href=\u0022https:\/\/mexicobusiness.news\/cybersecurity\/news\/non-human-digital-identities-new-cybersecurity-threat\u0022\u003E\u003C\/div\u003E\u003Cscript type=\u0022text\/javascript\u0022\u003E(function() {var po = document.createElement(\u0027script\u0027); po.type = \u0027text\/javascript\u0027; po.async = true;po.src = \u0027https:\/\/apis.google.com\/js\/plusone.js\u0027;var s = document.getElementsByTagName(\u0027script\u0027)[0]; s.parentNode.insertBefore(po, s);})();\u003C\/script\u003E\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022http:\/\/twitter.com\/share\u0022 class=\u0022twitter-share-button\u0022 data-url=\u0022https:\/\/mexicobusiness.news\/cybersecurity\/news\/non-human-digital-identities-new-cybersecurity-threat\u0022 data-count=\u0022horizontal\u0022 data-via=\u0022Non-Human Digital Identities: The New Cybersecurity Threat\u0022\u003ETweet\u003C\/a\u003E\u003Cscript type=\u0022text\/javascript\u0022 src=\u0022http:\/\/platform.twitter.com\/widgets.js\u0022\u003E\u003C\/script\u003E\u003C\/li\u003E\u003Cli\u003E\u003Cdiv id=\u0022fb-root\u0022\u003E\u003C\/div\u003E \u003Cscript\u003E(function(d, s, id) { var js, fjs = d.getElementsByTagName(s)[0]; if (d.getElementById(id)) return; js = d.createElement(s); js.id = id; js.src = \u0022\/\/connect.facebook.net\/en_US\/all.js#xfbml=1\u0022; fjs.parentNode.insertBefore(js, fjs); }(document, \u0027script\u0027, \u0027facebook-jssdk\u0027));\u003C\/script\u003E \u003Chtml fb=\u0022http:\/\/ogp.me\/ns\/fb#\u0022\u003E\r\n\u003Cdiv class=\u0022fb-like\u0022 data-href=\u0022https:\/\/mexicobusiness.news\/cybersecurity\/news\/non-human-digital-identities-new-cybersecurity-threat\u0022 data-layout=\u0022box_count\u0022 data-action=\u0022like\u0022 data-size=\u0022small\u0022 data-show-faces=\u0022true\u0022 data-share=\u0022true\u0022\u003E\u003C\/div\u003E\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022mailto:?subject=https:\/\/mexicobusiness.news\/cybersecurity\/news\/non-human-digital-identities-new-cybersecurity-threat\u0022 class=\u0022sharebar-button email\u0022\u003EEmail\u003C\/a\u003E\u003C\/li\u003E\u003C\/ul\u003E”,”width”:”85″,”position”:”left”,”top_offset”:”200″,”left_offset”:”5″,”right_offset”:”0″},”statistics”:{“data”:{“nid”:”65957″},”url”:”\/core\/modules\/statistics\/statistics.php”},”user”:{“uid”:0,”permissionsHash”:”d5cfe5151b3ffc53c5d130d9e05e2100e43cfffcac57d2afbf37c73af1c6771d”}}
——————————————————-
Click Here For The Original Source.
