Legacy IAM, or traditional identity and access management, is the older model of controlling who can use a system and what they can do. It is usually built around human users, static groups, and fixed application roles. Access is often granted once and then reviewed later, rather than being tightly adjusted to each task, session, or runtime condition.
This matters in cyber security because many modern services are no longer just passive applications. AI agents, scripts, service accounts, and integrations can make decisions and trigger actions across tools. Legacy IAM can struggle to express that kind of dynamic, delegated access, which can lead to overbroad permissions, weak audit trails, and access that lasts too long. Attackers exploit those gaps by abusing privileged accounts, stale roles, or shared credentials; defenders respond with least privilege, short-lived tokens, stronger logging, and more granular policy controls.