When it comes to IT security, most people first think of firewalls, phishing attacks or complex cyberattacks. However, many overlook one of the biggest weaknesses, which is often homemade: access management.

The figures speak for themselves. Various studies show that between 30 and 70 percent of companies have experienced at least one security incident in which unauthorized access was made possible by inadequate rights management. This makes it clear that identity and authorization management is not a marginal issue. It is a central security factor that we should no longer underestimate.

In practice, access management looks like a patchwork quilt in many organizations. Processes have grown over the years, systems have been added to, responsibilities have shifted, usually without a consistent concept. Rights are assigned manually, Excel lists are maintained, e-mails are sent back and forth. And transparency about who actually has access to what? Not at all.

Things get particularly tricky when roles change. Employees change departments, take on new tasks or leave the company altogether. External service providers join for specific projects and then leave again. The problem: access rights often remain in place for much longer than they should. Simply because no one has an overview or feels responsible.

There is also a structural communication problem. IT and specialist departments often do not speak the same language. While the IT department manages systems and technical processes, the specialist departments decide on specialist access. Without clearly defined workflows and regular coordination, this is precisely where the gaps arise that are exploited in the worst cases.

There are many striking figures circulating in the discussion about security incidents. It is worth taking a differentiated view, as not all of them stand up to close scrutiny.

A study by Ponemon and Imprivata, for example, shows that 47 percent of the companies surveyed have experienced at least one security incident in connection with faulty third-party access management. In earlier surveys, this figure was as high as 70 percent. In turn, the SailPoint Identity Security Study reports that over 70 percent of companies have detected unlawful access to sensitive data in the past – often caused by overly broad roles or a lack of recertification.

The Verizon Data Breach Report also emphasizes the high proportion of human error and weak processes in security breaches. And that’s exactly where unclean authorization management comes in.

However, it is important to classify them correctly: the often quoted statement that 75% of all security incidents are due to incorrect access management is not tenable. Realistically, we are talking about the proportion of organizations that have experienced at least one such incident, not all security incidents in total. A subtle but important difference.

For IT managers, compliance officers and CISOs, access management has long been more than just an operational task. It has become a central component of risk management and governance.

Unclear or poorly documented authorization processes can be really expensive. They encourage data protection violations under the GDPR, make audits more difficult or jeopardize them and, in an emergency, lead to business interruptions and reputational damage. Overprivileged accounts pose a particular risk. These are accounts with more rights than would actually be necessary for the task in question. They are convenient in everyday life, but highly critical from a security perspective.