Identity, Privileged Access & Zero Trust Posture

ClearPath Manufacturing · 38,000 employees · OT/IT convergence environment

Directory Sync: Active PAM Vault: Healthy Risk Tier: Medium
Privileged Path Risk
68
+3 vs target
Standing Privileged
142
Target: <85
MFA Coverage
96.2%
+1.8% MoM
Entitlement Drift
4.1%
+0.4% QoQ
PAM Adoption
73%
+5% QoQ
Impossible Travel
0.08%
-0.02% WoW

Privileged Access Path Flow

User roles → entitlements → crown jewel systems. Thickness = account count.

Entitlement Drift by Department

MFA Gap Breakdown

Standing Privileged Accounts — Last Use Audit

Account Role Last Auth MFA PAM Session Risk
admin_jdoe Domain Admin 92 days ago No — Critical
svc_backup_prod Service Account 2 hours ago Yes Active Low
admin_msmith Domain Admin 97 days ago No — Critical
erp_admin_finance ERP Full Admin 1 day ago Yes Active Medium
db_admin_ops Database Admin 4 hours ago Yes Active Low
cloud_admin_infra Cloud Admin 12 hours ago Yes Active Low
contractor_temp_admin Temp Admin 14 days ago Yes — Medium
network_admin_ot OT Network Admin 6 hours ago Yes Active Low
2 dormant domain admin accounts flagged for immediate review and offboarding.

PAM Session Adoption (90-day)

Impossible Travel Detections (30-day)

Service Account Credential Age (P95)

P95: 284 days · Target: <180

Zero Trust Crown Jewel Coverage

82% of sensitive apps protected

ATO Block Rate vs. Auth Friction

Block rate 94% · Friction score 2.1/10

Top Entitlement Drift Offenders

Finance Department
ERP role template change • 87 users affected
11.2%
IT Operations
Orphaned cloud admin roles • 34 users
6.8%
Engineering
Contractor role bloat • 22 users
4.9%
Supply Chain
Legacy system role drift • 19 users
3.7%

Remediation Playbook

Finance ERP Role Cleanup
Review & revoke 87 drifted entitlements
Dormant Admin Offboarding
Disable 2 critical admin accounts
Service Account Rotation
Rotate credentials >180 days old
MFA Gap Remediation
Enable MFA on 3.8% remaining users
IdP Sync: Last run 14 min ago
PAM Vault Health: Healthy · 99.7% uptime
Next Review: Mon, Jan 15, 2025
Dashboard refresh: Every 15 min · Data sources: Okta, CyberArk, HRIS, UEBA