Most breaches don't involve exotic exploits. They involve stolen credentials, unmanaged privilege, and accounts that should not have existed in the first place.
There is a persistent myth in cybersecurity that breaches happen because attackers are technically brilliant. That somewhere out there a genius is writing novel exploit code, finding zero-days in your firewall, and tunneling through your network like a ghost.
Sometimes that happens. Most of the time it doesn't.
Most of the time, the attacker just logs in.
Why It Matters
The 2024 Verizon Data Breach Investigations Report found that stolen credentials were involved in the majority of breaches analyzed that year. Not malware. Not zero-days. Credentials. Someone got a username and password that worked, and they used it.
This matters because it fundamentally changes where your defensive energy should go. You cannot patch your way out of a credential problem. You cannot firewall your way out of it either. If the attacker has valid credentials for a legitimate account, most of your perimeter controls wave them through without a second thought.
The question is not whether your walls are high enough. The question is who has the keys, how many copies exist, and whether you would know if one went missing.
The PAM Lesson
Credential-based attacks follow a predictable pattern. Understanding it is the first step to interrupting it.
PAM controls interrupt this pattern at multiple points. Vaulting credentials removes them from the places attackers commonly find them — configuration files, scripts, shared drives, memory. Least privilege limits what a compromised account can actually reach. Just-in-time access means standing privilege isn't sitting there waiting to be stolen. Session monitoring means that even when someone does get in, what they do is recorded.
None of these controls make a breach impossible. Together, they make the attacker's job significantly harder and make your detection and response significantly faster.
The Account Nobody Is Watching
There is a specific account type that shows up repeatedly in post-breach forensics: the orphaned account.
A former employee. A contractor who finished a project. A service account tied to a system that was decommissioned. An integration that was replaced but never cleaned up. The account still exists. In some cases it still has significant privilege. Nobody is actively using it, which means nobody is actively watching it.
Attackers love orphaned accounts. An account that nobody owns is an account that nobody will notice being used.
A PAM program that includes regular access reviews — not annual checkbox reviews, but genuine periodic audits of who has what and whether they still need it — closes this gap. It is not glamorous work. It is some of the most important work in your security program.
What to Check This Week
The attacker does not need to be smart. They need you to leave the door unlocked. PAM is how you start locking it.