Actively identifying and neutralizing network hot spots

A non-transitory computer readable medium including instructions that, when executed by at least one processor, cause the at least one processor to perform operations for actively identifying identities that have privileged access escalation vulnerabilities, the operations comprising:

• identifying a first identity having a first level of privileged access;
• identifying a second identity having a second level of privileged access that is different from the first level of privileged network access;
• based on the identification of the second identity gaining access to the first identity and further based on determining that the first identity and the second identity have different levels of privileged access, classifying the second identity as a potential source of privileged access escalation vulnerabilities;
• and
• performing, based on the classification that the second identity is a potential source of privileged access escalation vulnerabilities, at least one of:
• triggering an alert regarding the potential source of privileged access escalation vulnerabilities;
• performing a network security remediation operation for at least one of the first identity and the second identity;
• and
• identifying a plurality of other identities with levels of privileged access different from the first level of privileged access and that share a characteristic in common with the second identity.

A computer-implemented method for actively identifying identities that have privileged access escalation vulnerabilities, the method comprising:

• identifying a first identity having a first level of privileged access;
• identifying a second identity having a second level of privileged access that is different from the first level of privileged network access;
• based on the identification of the second identity gaining access to the first identity and further based on determining that the first identity and the second identity have different levels of privileged access, classifying the second identity as a potential source of privileged access escalation vulnerabilities;
• and
• performing, based on the classification that the second identity is a potential source of privileged access escalation vulnerabilities, at least one of:
• triggering an alert regarding the potential source of privileged access escalation vulnerabilities;
• performing a network security remediation operation for at least one of the first identity and the second identity;
• and
• identifying a plurality of other identities with levels of privileged access different from the first level of privileged access and that share a characteristic in common with the second identity.