What is the difference between vertical and horizontal escalation?

Vertical escalation gains a higher privilege level, such as a standard user obtaining administrator rights. Horizontal escalation gains the access of a different account at a similar level, such as reading another user’s data. Both expand what the attacker can reach, and real attacks typically chain the two.

Are escalation attacks always based on software vulnerabilities?

No. In enterprise environments, misconfigurations and exposed credentials account for a large share of escalations: over-permissioned service accounts, weak permissions on privileged tasks, cached admin passwords and permissive directory rights. These require no exploit at all, which is why hardening and privilege hygiene matter as much as patching.

How does PAM reduce escalation risk?

PAM removes the raw material of credential-based escalation: privileged passwords are vaulted and rotated instead of cached and reused, standing admin rights give way to time-limited grants, and privileged sessions are brokered and recorded. An attacker on a compromised endpoint finds no stored admin credential to escalate with.

Privilege Escalation

What is Privilege Escalation?

Privilege escalation is gaining higher access rights than granted, turning a low-level foothold into administrative control of systems or the domain.

Last updated: 15 July 2026

How privilege escalation works

Privilege escalation comes in two directions. Vertical escalation raises the level of access: an ordinary user becomes a local administrator, a local administrator becomes a domain administrator. Horizontal escalation keeps the level but changes the identity: one user’s access is used to act as another user with different reach.

Attackers get there through several broad routes. Software flaws in operating systems and drivers can hand kernel-level control to unprivileged code. Misconfigurations are at least as common: services running with excessive rights, weak permissions on files or scheduled tasks that privileged processes execute, and directory permission chains that let a low-value account modify a high-value one. Finally, credential-based escalation skips the technical work entirely, when an admin password is cached, reused or guessable, the attacker simply logs in with it.

Why it matters

Escalation is the pivot point of almost every serious intrusion. The initial foothold, a phished user or an exposed service, usually has little value on its own; the damage begins once the attacker gains rights that let them disable security tooling, create accounts, access any data and erase evidence. Ransomware operations in particular depend on reaching domain-level privilege to deploy encryption everywhere at once.

Escalation paths also accumulate silently as environments evolve. Every over-permissioned service account, nested group grant and forgotten admin right added over the years widens the attacker’s options, which is why mature security programs treat the discovery and removal of escalation paths as continuous work rather than a one-time audit.

How to prevent privilege escalation

Least privilege is the foundation: users work without admin rights, service accounts get only the permissions their service needs, and administrative roles are separated by tier so compromising a workstation admin does not expose domain credentials. Prompt patching of operating systems and privileged software closes the exploit-based routes, while configuration hygiene, correct service permissions, protected scheduled tasks and reviewed directory ACLs, closes the misconfiguration routes.

The credential route is closed by removing standing privilege altogether. When admin rights exist only as just-in-time grants and privileged passwords live in a vault with automatic rotation, as Monopam provides, there is little for an attacker to find and reuse. Monitoring completes the picture: new members in privileged groups, services installed with high rights and unexpected use of elevation mechanisms all warrant alerts.

Frequently asked questions

What is the difference between vertical and horizontal escalation?: Vertical escalation gains a higher privilege level, such as a standard user obtaining administrator rights. Horizontal escalation gains the access of a different account at a similar level, such as reading another user’s data. Both expand what the attacker can reach, and real attacks typically chain the two.
Are escalation attacks always based on software vulnerabilities?: No. In enterprise environments, misconfigurations and exposed credentials account for a large share of escalations: over-permissioned service accounts, weak permissions on privileged tasks, cached admin passwords and permissive directory rights. These require no exploit at all, which is why hardening and privilege hygiene matter as much as patching.
How does PAM reduce escalation risk?: PAM removes the raw material of credential-based escalation: privileged passwords are vaulted and rotated instead of cached and reused, standing admin rights give way to time-limited grants, and privileged sessions are brokered and recorded. An attacker on a compromised endpoint finds no stored admin credential to escalate with.