Identity and access management, or IAM, is the set of processes and tools that ensures every person and system has access only to what they need to work, for only as long as necessary. It answers three questions: who has access to a system, why, and for how long.
Many companies cannot answer these questions quickly, which is why identity has become one of attackers' preferred routes.
Why identity became the main entry point
The cheapest route for an attacker is to obtain valid credentials and log in as an employee. Vultus's 2026 Cyber Risk Landscape, a study of 132 organizations, shows the scale of this problem: 38.1% had a cloud environment without multifactor authentication, large-scale attempts using predictable passwords worked in 35.7%, credentials stolen by infostealers provided a shortcut in 21.4%, and VPN access was possible from scratch in 23.8%.
None of these paths requires a sophisticated technique. They are identity management failures.
The international landscape is similar. In the M-Trends 2026, from Google Cloud, voice phishing was the most common vector in cloud intrusions, accounting for 23% of cases, followed by third-party compromise (17%) and stolen credentials (16%).
The lifecycle of access
All access goes through joining, moving, and leaving. At onboarding, a common mistake is copying a teammate's access and inheriting permissions accumulated over years. When someone moves to another department, they receive new access without losing their previous permissions, eventually gaining access to almost everything.
When someone leaves, access should be revoked the same day. The common mistake is revoking email access while forgetting the financial system, VPN, or cloud tool purchased by the department.
The concepts that organize access
Least privilege gives each person the minimum access needed to work and limits damage when a credential leaks. Role-based access control (RBAC) defines what each role needs and simplifies granting, reviewing, and revoking access. Segregation of duties (SoD) prevents the same person from registering a vendor and approving payment to that vendor.
Privileged accounts, such as administrators, service accounts, and emergency access accounts, are few in number and highly valuable to attackers. They require dedicated controls, including a password vault, recorded sessions, and access only when needed. Periodic access reviews by managers are the simplest control and one of the most neglected.
Where to start
A sequence that usually works:
- Second factor: for email, VPN, cloud, and critical systems accessible externally.
- Same-day offboarding: integration between HR and access revocation.
- Privileged account inventory: how many exist, who uses them, and when they were used.
- First access review: starting with critical systems.
- Role-based access profiles: after cleaning up accumulated permissions, to avoid formalizing inappropriate access.
Buying an IAM platform without defining who approves, reviews, and revokes access tends to reproduce the same problems in a new dashboard. Controlling who accesses personal data is also one of the measures expected under LGPD.
Identity and access governance
Vultus structures identity management with access policies, role-based profiles, segregation rules, provisioning and revocation processes, and specific treatment for privileged accounts. Explore Vultus identity and access management and read about infostealers.
