How to Score Identity Risk
Most breaches ride in on a compromised identity, and the identities that matter are no longer just people — service accounts, keys and AI agents now outnumber humans many times over. This guide shows you how to score identity risk: inventory every identity, weigh privilege, credential posture, exposure and blast radius, then rank and reduce the worst.
In plain words
Scoring identity risk means ranking every identity — human, service and AI — by how dangerous it would be if compromised, and PlayCISO has a free, browser-based identity risk tool that does it with you. The score combines four things: privilege held, credential and key posture, exposure, and blast radius.
Non-human identities usually outnumber people and are the most overlooked, so start by inventorying all three types. Blast radius is the factor that turns one stolen credential into a full breach — fix the widest-reaching, weakest-protected identities first.
Step by step
- 1
Inventory every identity — human, service and AI
You cannot score what you cannot see. Build an inventory that covers human accounts, non-human/service identities (service accounts, API keys, CI/CD tokens, workload identities) and the newer category of AI identities (agents, bots and assistants that act with their own credentials). In most environments non-human identities now vastly outnumber human ones, and they are the most commonly overlooked, so make sure they are in scope.
- 2
Classify each identity by type and owner
Tag every identity with its type (human, service, AI), a responsible owner, and its purpose. Identities with no clear owner or purpose are a risk signal in their own right — orphaned and unknown accounts are prime targets because no one notices their misuse. This classification lets you apply the right expectations: a service account should not log in interactively, an AI agent should have narrowly scoped permissions.
- 3
Assess privilege
Score how much power each identity holds: administrative rights, access to sensitive data, ability to change configuration or other identities, and whether privileges are standing or just-in-time. Standing high privilege is the single biggest multiplier of identity risk. Flag over-privileged accounts, unused entitlements, and any identity whose access exceeds what its role actually requires.
- 4
Evaluate credential and key posture
Look at how each identity authenticates and how well that is protected: MFA coverage and strength for humans, secret rotation and storage for service accounts and keys, and whether long-lived static credentials exist where short-lived tokens should. Stale passwords, unrotated keys, secrets in code, and missing MFA all raise the score because they make the identity cheap to compromise.
- 5
Measure exposure
Factor in how reachable and attackable each identity is: internet-facing versus internal, breadth of access paths, presence in known breach or credential-leak datasets, and signs of phishing or token-theft risk. An identity with strong privilege but tight exposure is less urgent than a moderately privileged one that is widely reachable and already leaking. Exposure turns latent privilege into live risk.
- 6
Estimate blast radius
For each high-scoring identity, map what an attacker could reach if it were compromised — the systems, data and other identities it can touch, and whether it can escalate or move laterally. Blast radius is what converts a single compromised credential into a full breach, so identities that can pivot widely deserve the highest priority regardless of how they rank on other factors alone.
- 7
Score, prioritize and reduce
Combine privilege, credential posture, exposure and blast radius into a single risk score per identity so you can rank them and act on the worst first. Then reduce the top scores: enforce MFA, remove standing admin and move to just-in-time access, rotate or eliminate long-lived secrets, deprovision orphaned identities, and tighten scopes on AI and service identities. Re-score after each change to confirm the risk actually fell.
Weigh privilege, credential posture, exposure and blast radius across human, service and AI identities, and get a ranked list of what to fix first — free, in your browser.
Related
The interactive scoring tool this guide walks through, across all three identity types.
Zero trust assessmentIdentity is the zero trust control plane — assess the architecture around it.
All PlayCISO toolsScanners and assessments to feed your identity inventory and posture inputs.
PlayCISO labsIncident simulations that show how a single compromised identity becomes a breach.
Frequently asked questions
What counts as an identity for scoring?
Anything that authenticates and is granted access — not just people. That includes human accounts, non-human identities like service accounts, API keys, CI/CD tokens and workload identities, and increasingly AI identities such as agents and bots that hold their own credentials. Non-human identities usually outnumber humans by a wide margin and are the most overlooked, so leaving them out gives you a badly incomplete picture.
Why are service and AI identities so risky?
They often carry broad, standing privileges, authenticate with long-lived static secrets, and are poorly inventoried and rarely rotated — a combination that makes them both powerful and easy to compromise. Unlike human accounts they usually lack MFA and are not tied to a person who would notice misuse. AI agents add the twist of acting autonomously, so an over-scoped agent can do real damage quickly if its credential leaks.
What makes one identity riskier than another?
Four factors combine: how much privilege it holds, how well its credentials are protected, how exposed and reachable it is, and how large its blast radius would be if compromised. A heavily privileged identity with weak authentication, broad exposure and the ability to move laterally is the worst case. Scoring all four together lets you rank identities rather than treating them as uniformly risky.
What is blast radius and why does it dominate?
Blast radius is everything an attacker could reach, change or escalate to if they compromised a given identity — the systems, data and other identities it can touch. It matters most because it is what turns one stolen credential into a full breach rather than a contained incident. Two identities with identical privilege can carry very different risk if one is isolated and the other can pivot across the environment.
How do I reduce a high identity risk score?
Attack the factors driving the score: enforce strong MFA, remove standing administrative rights in favor of just-in-time elevation, rotate or eliminate long-lived secrets and keys, deprovision orphaned and unused identities, and tighten the scopes on service and AI identities to the minimum they need. After each change, re-score to confirm the risk genuinely dropped rather than assuming the fix worked.
How often should identity risk be scored?
Identity changes constantly — new accounts, new agents, role changes and new entitlements appear every week — so scoring should be continuous or at least run on a frequent cadence rather than annually. At a minimum, re-score after major changes such as new integrations, acquisitions, or the introduction of AI agents, and whenever a credential-leak dataset implicates one of your identities.