Identity and access management's flexibility and rapid changes may lead to over-privileged users and the potential for abuse and privilege escalation, including obfuscation techniques.