Identity GlossaryLast updated July 17, 2026

Identity Risk Score

A neutral definition of an identity risk score: the composite metric that ranks accounts by exposure, and the inventory it depends on to be accurate.

What Is an Identity Risk Score?

An identity risk score is a composite metric that ranks an account or identity by how much exposure it represents, typically built from signals like privilege level, staleness, group membership, credential hygiene (rotation history, MFA presence), and known compromise indicators. Instead of reviewing every account with equal attention, a team can triage the highest-scoring identities first.

The specific inputs and weighting vary by vendor and by organization, but the goal is consistent: turn a long, undifferentiated list of accounts into a ranked queue. A domain admin account that hasn’t rotated its password in two years and shows compromised-credential indicators should score meaningfully higher than a routine, recently-provisioned user account, and the score should make that difference visible at a glance.

A risk score is a summary of whatever inventory it was calculated against. If the underlying account inventory is incomplete or stale, the score for the accounts it does see may be accurate while the biggest risk in the environment, an account that was never in the inventory at all, never gets scored in the first place. The score is only as trustworthy as the discovery underneath it.

Share

What Typically Feeds an Identity Risk Score

Most risk-scoring models draw on the same handful of signal categories.

1

Privilege Level

How much an account can do if compromised: administrative rights, group membership, and standing privilege.

2

Staleness & Activity

Whether an account is still in active use, and how long it’s been since a password rotation, review, or login.

3

Credential Hygiene

Rotation history, MFA presence, credential-sharing patterns, and whether a secret is stored in plaintext.

4

Compromise Indicators

Signals like breached-credential matches, anomalous login patterns, or known-bad IP associations.

5

Ownership Clarity

Whether the account has a current, identifiable owner, since orphaned accounts carry elevated risk by default.

Frequently Asked Questions

See the Identity System of Record in Action

Hydden discovers, reconciles, and continuously governs every identity (human, machine, and agentic) across your enterprise.

© 2026 Hydden Inc. All rights reserved.Privacy PolicyTerms of Service