A computer-implemented method for actively identifying network resources that have privileged access escalation vulnerabilities, the method comprising: identifying a first identity having a first level of privileged network access; identifying a network resource that the first identity is communicating with; classifying the network resource as a network resource to be dynamically monitored; dynamically monitoring connections activity of the identified network resource to determine a second identity , wherein the second identity is determined based on it having a second level of privileged network access that is different from the first level of privileged network access and having attempted to establish a connection with the network resource ; classifying , based on the determination of the second identity , the network resource as a potential source of privileged access escalation vulnerabilities; and performing , based on the classification that the network resource is a potential source of privileged access escalation vulnerabilities, at least one of: triggering an alert regarding the potential source of privileged access escalation vulnerabilities; performing a network security remediation operation for at least one of the first identity , the second identity , and the network resource ; and identifying a plurality of other identities with levels of privileged network access different from the first level of privileged network access and that have attempted to establish connections with the network resource . identifying a first identity having a first level of privileged network access; identifying a network resource that the first identity is communicating with; classifying the network resource as a network resource to be dynamically monitored; dynamically monitoring connections activity of the identified network resource to determine a second identity , wherein the second identity is determined based on it having a second level of privileged network access that is different from the first level of privileged network access and having attempted to establish a connection with the network resource ; classifying , based on the determination of the second identity , the network resource as a potential source of privileged access escalation vulnerabilities; and performing , based on the classification that the network resource is a potential source of privileged access escalation vulnerabilities, at least one of: triggering an alert regarding the potential source of privileged access escalation vulnerabilities; performing a network security remediation operation for at least one of the first identity , the second identity , and the network resource ; and identifying a plurality of other identities with levels of privileged network access different from the first level of privileged network access and that have attempted to establish connections with the network resource . triggering an alert regarding the potential source of privileged access escalation vulnerabilities; performing a network security remediation operation for at least one of the first identity , the second identity , and the network resource ; and identifying a plurality of other identities with levels of privileged network access different from the first level of privileged network access and that have attempted to establish connections with the network resource . <EOS>