Secordit home
Contact

What is privilege escalation?

Higher access than an attacker first had is described in NCSC guidance as privilege escalation. In guidance on preventing lateral movement, after an attacker has a first foothold they will typically try to broaden it. That guidance says the attacker will usually try to compromise additional hosts and escalate their privileges. 1

By Secordit. Last checked: 10 November 2026.

Go to the steps · All glossary terms

How it works

  1. After a first foothold, NCSC says the attacker will typically try to broaden it. The aim is to reach an important system or important data. 1
  2. In that NCSC usage, privilege escalation means obtaining a higher level of access than they first had, for example administrative rights they were not given. 1
  3. The same guidance stresses protecting credentials, especially administrator accounts, detecting breaches early, and not relying only on a strong outer boundary. 1

What UK guidance says

NCSC identity and access management guidance covers controlling who and what can access systems and data. That includes joiners, movers and leavers, and more than one person to authorise some actions. The least privilege glossary page covers the idea that people and accounts should only have the access they need. 21

Warning signs

  • Administrator accounts and other powerful credentials are widely shared, or are not protected as the lateral-movement guidance describes. 1
  • Access is not reviewed when people join, change role or leave. 2
  • A strong outer boundary is treated as the only control, which that NCSC guidance warns against relying on alone. 1

What to do now

  1. Give people and accounts only the access they need, and protect administrator credentials. 12
  2. Use joiners, movers and leavers processes so access is reviewed when roles change. More than one person can be required to authorise some actions. 2
  3. If a breach is suspected, follow NCSC incident guidance and, where a crime has taken place, use Report Fraud or Police Scotland on 101. 43567

UK reporting and support

How to protect yourself

  • Protect credentials, especially administrator accounts, and do not rely only on a strong outer boundary. 1
  • Control who and what can access systems and data, including when people join, change role or leave. 2
  • Limit what a first foothold can reach, rather than relying on the outer boundary alone. 1

Frequently asked questions

What is privilege escalation, in plain English?

It means obtaining a higher level of access than an attacker first had, for example administrative rights they were not given. NCSC describes this as something an attacker will usually try after a first foothold, alongside compromising additional hosts. 1

Is this only a large-organisation problem?

The NCSC guidance on this topic is written for system owners. NCSC identity and access management guidance also covers controlling access, including joiners, movers and leavers. Families do not need the term to follow unique passwords, 2-step verification, and care over who can approve access. 12

Does this page explain how privilege escalation is done?

No. This page explains the idea only. It does not describe methods, tools or operating-system steps. 1

Matching kit

Joiners, Movers and Leavers Access Checklist · £19 · Digital download.

A printable checklist and editable access record for when people join, change role or leave. It does not replace your own access decisions.

General information, not legal, financial or personalised security advice. Secordit is not a police or bank reporting service.

News Pulse

Account security, explained by email.

Read about News Pulse

Sources

  1. NCSC, Preventing lateral movement. Accessed 10 November 2026 (Europe/London).
  2. NCSC, Identity and access management. Accessed 10 November 2026 (Europe/London).
  3. NCSC, Help for individuals. Accessed 10 November 2026 (Europe/London).
  4. Report Fraud, Report Fraud. Accessed 10 November 2026 (Europe/London).
  5. Report Fraud, Guide to reporting cyber crime and fraud. Accessed 10 November 2026 (Europe/London).
  6. Police Scotland, How to report a crime - Police Scotland. Accessed 10 November 2026 (Europe/London).
  7. Report Fraud, Reporting cyber crime and fraud or phishing attempts - Report Fraud. Accessed 10 November 2026 (Europe/London).