What happened
The Department of Homeland Security's Office of Inspector General opened an audit of U.S. Customs and Border Protection in late 2024 to test how the agency applies information technology access controls. The audit ran through December 2025 and included technical assessments and penetration testing. The findings, reported this week by DataBreachToday, are blunt.
Every user on CBP's network, the entire workforce of more than 76,000 employees, could operate a service account with elevated privileges and make changes to credentials and security settings. The watchdog said it identified "multiple access control vulnerabilities, which could allow an attacker to compromise CBP's network, gain access to sensitive information and disrupt mission-critical operations." CBP could not always tell which of its accounts carried elevated privileges in the first place, and it did not reliably strip access when people left the agency or moved to different roles.
The inspector general's office mapped more than 100 attack paths through CBP's environment and has asked the agency to show that each one was analyzed and that unnecessary access was cut back. CBP attributed the lapses to human error and to an inability to track how account access changed over time. The agency runs more than 100 major IT applications across 4,500 facilities, some holding sensitive law enforcement data.
Why this is a GRC story
This is a textbook failure of two fundamentals: privileged access management and identity lifecycle. Service accounts run automated processes and are watched less closely than human accounts, which makes them a favorite target for an intruder who already has a foothold. One overprovisioned service account can be the difference between a contained incident and a network-wide disruption.
The deeper governance problem sits in CBP's own explanation. Human error and an inability to track how access changed over time are not excuses, they are the diagnosis: no automated identity governance, no regular certification of who holds what, no reliable offboarding process. An organization that cannot inventory its privileged accounts cannot monitor them, and an organization that cannot monitor them cannot defend them.
If a border agency with 76,000 staff and a security mission can drift this far from baseline access hygiene, any company can. The controls that matter here are not exotic: document every privileged account, enforce least privilege, tie access to role, revoke on departure, and review entitlements on a fixed cycle.
What to watch
Watch how CBP responds to the more than 100 attack paths the watchdog mapped. The inspector general has asked for proof that each path was analyzed and that unnecessary access was removed, so the agency's corrective action plan will be a useful case study in how a large organization digs itself out of an access control hole.
For your own environment the question is shorter: when did you last attest every privileged and service account, and how fast do leavers lose access today? Those two answers will tell you whether this story is someone else's problem or a preview of your next audit finding.
Attribution: Analysis based on DataBreachToday and related public reporting. This article is original commentary, not a repost of the source material.