Module 3: Discovery & Assessment

Layla hands Priya one instruction: find it, all of it. Priya works through nine discovery sources, from access control lists and Active Directory to logs and interviews. She sets one rule, collect once and audit forever, and follows it for every account, including the AI identities nobody hired. Six weeks later, 312 privileged accounts that nobody had on any list are recorded, owned and ranked by risk.

Discovery and assessment means identifying, categorising and assessing every privileged account and access path. It is the ground the strategy, controls and programme scope stand on.

Priya's rule: capture four layers for every account in one pass (account and asset, JML linkage, access patterns, password reality), so reviews, audits and incidents never have to start again from scratch.

Access control lists, role-based analysis reviews, privileged user lists and user and group permission reviews reveal special permissions, inherited rights and privilege creep. Each comes with a real-world case study.

At survey depth: AI as a lens on the data, as a holder of privilege, as a break in the four-layer record, as a new part of the estate, as unapproved shadow AI and as an attacker capability. The test throughout is: if it can log in, it goes in the book.

Active Directory and the IAM system provide privileged account identification, group nesting, dormant accounts and lifecycle data. A field guide covers automation, risk-based priorities, clear ownership and continuous assessment.

Accounts are categorised by risk, then SIEM and syslog data, user access reviews and interviews with privileged users show how access is actually used. Interview accounts are checked against the records.

Account, asset and application records are joined into one inventory. The final tally of 312 unlisted privileged accounts goes to Layla, and Omar takes the risk-ranked list into Module 4.