Access brokerage is the criminal trade of turning unauthorized footholds into a commodity. An attacker first compromises a system, then “qualifies” the access by checking what the host is, what privileges it has, and whether it is valuable enough to sell. The result may be a login session, remote access, or a persistent foothold offered to other criminals.
This matters because it separates intrusion from the final abuse. The first intruder is not always the one who steals data, deploys ransomware, or performs fraud; they may simply prepare inventory for a marketplace. In real attacks, access brokers look for signs of business value, such as domain membership, privileged accounts, payment workflows, or corporate networks. Defenders can reduce this risk with strong authentication, least privilege, rapid detection of unusual remote access, and fast containment of compromised hosts before the foothold can be resold.