A computer-implemented method for actively identifying network resources that have privileged access escalation vulnerabilities, the method comprising: identifying a first identity having a first level of privileged network access; identifying a network resource that the first identity is communicating with; classifying the network resource as a network resource to be dynamically monitored; dynamically monitoring connections activity of the identified network resource to determine a second identity, wherein the second identity is determined based on it having a second level of privileged network access that is different from the first level of privileged network access and having attempted to establish a connection with the network resource; classifying, based on the determination of the second identity, the network resource as a potential source of privileged access escalation vulnerabilities; and performing, based on the classification that the network resource is a potential source of privileged access escalation vulnerabilities, at least one of: triggering an alert regarding the potential source of privileged access escalation vulnerabilities; performing a network security remediation operation for at least one of the first identity, the second identity, and the network resource; and identifying a plurality of other identities with levels of privileged network access different from the first level of privileged network access and that have attempted to establish connections with the network resource. identifying a first identity having a first level of privileged network access; identifying a network resource that the first identity is communicating with; classifying the network resource as a network resource to be dynamically monitored; dynamically monitoring connections activity of the identified network resource to determine a second identity, wherein the second identity is determined based on it having a second level of privileged network access that is different from the first level of privileged network access and having attempted to establish a connection with the network resource; classifying, based on the determination of the second identity, the network resource as a potential source of privileged access escalation vulnerabilities; and performing, based on the classification that the network resource is a potential source of privileged access escalation vulnerabilities, at least one of: triggering an alert regarding the potential source of privileged access escalation vulnerabilities; performing a network security remediation operation for at least one of the first identity, the second identity, and the network resource; and identifying a plurality of other identities with levels of privileged network access different from the first level of privileged network access and that have attempted to establish connections with the network resource. triggering an alert regarding the potential source of privileged access escalation vulnerabilities; performing a network security remediation operation for at least one of the first identity, the second identity, and the network resource; and identifying a plurality of other identities with levels of privileged network access different from the first level of privileged network access and that have attempted to establish connections with the network resource.