Privilege Escalation
Privilege escalation is the technique by which an attacker or process obtains permissions higher than those originally granted, converting limited access into broader control over systems and data.
Escalation Determines How Large the Incident Becomes
Initial access rarely lands anywhere valuable. A phishing click produces a session as one employee with ordinary permissions, and the difference between a contained incident and a company-wide one is whether that session can be turned into something with more authority. Loss modeling reflects this, since the same intrusion carries a different distribution depending on how far escalation ran.
Vertical and Horizontal Movement Differ
Vertical escalation raises authority within a system, taking a standard account to administrator through an unpatched kernel flaw, a misconfigured service or a credential cached on the host. Horizontal escalation keeps the same authority level and moves sideways to other accounts, which accumulates reach without ever triggering an alert tied to privileged access. MITRE ATT&CK catalogs both under its own tactic.
The Common Routes Are Configuration Problems
Credentials left in scripts and environment variables, service accounts holding permissions nobody reviewed, token theft from browser storage and identity provider misconfigurations supply most real-world escalations. None of them require an exploit. Control effectiveness assessments that score patching heavily and account hygiene lightly will misread an organization's exposure here.
AI Agents Introduce a New Route
An agent holding broad permissions becomes an escalation path for anyone who can influence its instructions, with no exploit involved, since the agent was always allowed to do what it was asked to do. The confused deputy problem describes the mechanism, and compensating controls written for human accounts rarely account for a non-human identity acting on instruction.
Related Terms
Turn Cyber Risk Into Financial Exposure the Board Can Act On
Security leaders are being asked to defend budgets, prioritize controls, and report cyber risk in the same terms as every other enterprise risk. Kovrr's CRQ Platform models loss scenarios, benchmarks control performance, and gives the C-suite a defensible view of where cyber sits on the balance sheet.
