Identity risk is the chance that legitimate user accounts, especially privileged or administrator accounts, will be misused by an attacker. It covers stolen passwords, token theft, phishing, session hijacking, and abuse of weak access controls. In cyber security, identity is often the first control plane an attacker targets because a valid login can look normal while giving broad access to email, cloud consoles, billing systems, or infrastructure tools.
This matters because account misuse can lead to data theft, service disruption, fraud, or changes that are hard to spot quickly. Defenders reduce identity risk with multifactor authentication, least-privilege access, strong password and token hygiene, conditional access, logging, and rapid account review when an extortion claim or suspicious activity appears. In real attacks, identity risk often shows up as unusual logins, privilege escalation, or admin actions that do not match normal operator behavior.