Permission sprawl is the gradual buildup of excessive or outdated access rights across accounts, applications, cloud services, and shared data. It can happen when employees change roles, temporary access is never removed, or permissions are granted broadly for convenience. As a result, people and service accounts may be able to reach more information than their work requires.
In a cyberattack, stolen credentials can expose data the compromised account was never meant to access, while overly broad permissions can help an intruder move between systems. Defenders reduce this risk by inventorying access, reviewing permissions regularly, removing unused rights, and applying least privilege: grant only the access needed for a task. Monitoring tools can help identify sensitive data that is widely accessible and flag unusual access for investigation.