Access sprawl is the buildup of excessive, outdated, or poorly governed permissions across users, service accounts, APIs, and workflows. It happens when organizations add new tools, integrations, or temporary exceptions faster than they remove or review access.
This matters because every extra permission increases the attack surface. In real attacks, adversaries often abuse overprivileged accounts, forgotten admin roles, stale API keys, or shared credentials to move laterally, reach sensitive data, or disrupt operations. Defenders reduce access sprawl by enforcing least privilege, using role-based access control, reviewing permissions regularly, separating human and machine accounts, and revoking unused access quickly. Strong MFA, logging, and access recertification help spot misuse before it becomes a breach.