Identity-or-Vulnerability Threat Model
Defend the two primary routes attackers use to enter an organization
- Difficulty
- Moderate
- Time to result
- ~weeks to results
- Steps
- 5
- Confidence
- 93%
This mental model reduces a complex attack surface to two dominant entry routes: compromised identities and exploited vulnerabilities. Identity attacks target usernames, passwords, authentication systems, and account privileges; vulnerability attacks exploit defective code, outdated software, or unsafe configurations. Leaders first inventory both surfaces, then strengthen authentication, reduce unnecessary access, patch software, and correct cloud or SaaS misconfigurations. Progress can be measured through account-control coverage, patch latency, configuration findings, and detected intrusion attempts. The model does not claim that every attack fits neatly into one category, but it creates a repeatable prioritization mechanism: address the routes attackers successfully use most often before investing heavily in narrower or more speculative defenses.
Origin
Adam Murray described the model while explaining the critical enterprise threats facing game studios on Security Bookmarked.
Core principles
- 01Most successful intrusions exploit identities or technical vulnerabilities
- 02Security investment should follow observed attacker behavior
- 03Strong fundamentals make an organization less attractive than easier targets
- 04Identity controls and vulnerability management must operate together
How to run it
- 1
Map identities
Inventory employee, administrator, contractor, and service accounts, including their privileges and authentication methods.
Pro tip Start with accounts that can access source code, assets, backups, or user administration.
Watch out Do not assume only formal administrators possess high-value access.
- 2
Strengthen account controls
Deploy strong authentication, remove stale accounts, and limit privileges to what each role requires.
Pro tip Measure coverage across every work application rather than only core systems.
Watch out A single weak application can provide an attacker with an entry point.
- 3
Inventory vulnerabilities
Identify outdated software, exploitable code, and unsafe cloud or SaaS configurations across the environment.
Pro tip Include externally exposed services and collaboration tools in the first pass.
Watch out Configuration weaknesses can be as exploitable as software defects.
- 4
Remediate by exposure
Patch or mitigate findings according to exploitability, exposure, and potential business impact.
Pro tip Prioritize weaknesses that provide access to crown-jewel assets or backups.
Watch out Do not let low-impact findings distract from remotely exploitable weaknesses.
- 5
Reassess continuously
Monitor account activity, patch status, and configuration drift, then repeat the assessment as systems and teams change.
Pro tip Review identity and vulnerability metrics in the same security meeting.
Watch out A one-time hardening project decays as new users, applications, and configurations appear.
In the wild
A studio inventories developers, administrators, build services, and cloud applications. It introduces strong authentication for high-value accounts, removes dormant users, patches exposed services, and reviews SaaS configurations that handle unreleased game assets.
→ The studio reduces both credential-based and technical entry opportunities without attempting to solve every security problem simultaneously.
Common mistakes
Protecting only administrator accounts
Developers may already possess direct access to source code and game assets, making them valuable targets without any privilege escalation.
Treating patching and identity as separate programs
Attackers can combine stolen credentials with vulnerabilities, so the two risk surfaces should be reviewed together.
Is it for you?
Best for
Organizations that need a practical starting point for allocating limited cybersecurity resources.
Not ideal for
Teams seeking a complete security architecture covering every specialized threat and regulatory requirement.
From the transcript
“Either attacking accounts so you can think user name, password, MFA, attacking that and getting access through that, or attacking vulnerabilities”
“If you can do those things to the right level, you're going to protect your company and you certainly won't be the low hanging fruit…”
From the episode
Security, Bookmarked: Gaming (Sponsored Content)