"This is proof that traditional access-based approaches, which rely on ad hoc security decisions or predefined lists of privileged identities, continue to fail," said Chris Morales, Security Analysis Manager at Vectra.