New research from Pathlock, a leading provider of secure access solutions, found that nearly half (48 percent) of manufacturers fail to revoke access within 24 hours of a role change or departure.
Dormant accounts tied to former contractors or seasonal workers rarely trigger behavioral alerts, making them a low-friction entry point for credential stuffing, password spraying and phishing. The research found that 46 percent of reported security incidents were suspected or confirmed to be linked to governance gaps created during digital transformation — pointing to a structural exposure, not just a process one.
Additional findings include:
- 51 percent don't use automated elevated access management.
- 14 percent have minimal or no governance over privileged access at all.
- Third-party consultants and internal IT admins — the users with the broadest permissions — are the hardest groups to manage.
- 61 percent skipped comprehensive segregation of duties (SoD) risk simulations before deploying new roles during cloud migrations
Industry stakeholders shared the following thoughts on the research.
Vincenzo Iozzo, CEO and Co-founder at SlashID
"Industry threat intelligence reports of the last several years show that more than 50 percent of intrusions are now identity based and malware-free. Often, attackers exploit stale credentials from past employees or contractors and overprovisioned accounts to breach customers.
"In fact, the combination of the two is what generally leads to significant damages similar to what we have recently observed with Stryker.
"The Pathlock report shows that one in five manufacturers has already suffered a security incident, and nearly half of those incidents trace back to governance gaps introduced during digital transformation. This once again demonstrates that identity deprovisioning and governance can no longer be treated simply as a GRC task."
James Maude, Field CTO at BeyondTrust
"Pathlock’s findings highlight a structural identity problem in manufacturing: attackers increasingly log in rather than break in, and dormant or over‑privileged accounts give them a frictionless path. During seasonal ramp‑ups, access is created quickly but rarely removed with the same urgency, leaving behind a shadow layer of identities that don’t trigger behavioral alerts. That expands the blast radius for everything from credential stuffing to insider misuse.
"Security teams should focus on shrinking standing privilege, ideally taking a just-in-time approach for privilege and access especially for contractors and integrators. When you reduce the amount of privilege in the system, you reduce the impact of inevitable mistakes."
Surya Kollimarla, Director, Identity Security Products at ColorTokens
"The Pathlock data doesn't reveal a new threat — it measures the one you're already carrying, quietly compounding inside your own systems. With 74 percent of manufacturers lacking fully automated provisioning, 61 percent skipping SoD simulations before cloud migrations, and dormant accounts evading behavioral alerts entirely, the attack surface isn't a gap — it's a design flaw.
"What security teams should know: faster offboarding and periodic access reviews are necessary but insufficient — the structural fix is removing credentials from the authentication chain altogether. Security teams should seriously evaluate two foundational shifts:
"Go passwordless by design, not by patch. Solutions that layer passwordless capabilities on top of password-based infrastructure don't eliminate the attack surface — they obscure it. True passwordless architecture, integrated with automated SoD enforcement across your existing ERP and IAM systems, removes the credential risk at the source.
"Authenticate based on context, not just identity. Risk-based authentication that continuously evaluates the user, device, and application at the moment of access is the only model that raises the security bar without adding friction — because friction doesn't get tolerated, it gets bypassed."
Darren Guccione, CEO and Co-Founder at Keeper Security
"Stale credentials remain one of the most predictable and dangerous weaknesses in enterprise security. When access persists after an employee changes roles, leaves or a contractor’s engagement ends, organizations effectively leave trusted identities active inside critical systems. Attackers understand this and routinely look for dormant accounts that will allow them to blend in as legitimate users to avoid triggering traditional security alerts.
"Manufacturing environments can be particularly exposed during seasonal workforce expansions. Organizations rapidly onboard contractors, system integrators and temporary staff to support production ramp-ups, often granting elevated permissions to operational systems. If those privileges are not revoked immediately when projects conclude, or permissions are granted too broadly, they create long-lived entry points and widespread access that adversaries can exploit.
"This is why identity governance must be treated as a security priority, not just a compliance process. Access should be automated, time-bound and continuously verified, privileged access must follow the principle of least privilege and standing administrative rights should be eliminated wherever possible. In today’s threat landscape, identity has become the primary attack surface. Organizations that fail to maintain strict control over who has access to what systems – and for how long – are effectively leaving the front door open to attackers."
