Put identity first: prioritise risks by context not volume

Identity Prioritization isn't a backlog problem; it's a risk math problem, argues The Hacker News in its 24 February 2026 piece, framing identity risk as a function of context rather than volume. According to The Hacker News, risk arises from a compound of controls posture, hygiene, business context, and user intent, and danger grows when these factors align to create toxic combinations.

The article proposes a practical four‑part prioritisation model: assess controls posture, identity hygiene, business context, and user intent, then fix work that yields the greatest risk reduction rather than merely closing the most findings. It also highlights common failure modes, such as missing MFA on privileged identities and the multiplicative nature of risk, with examples like orphan and dormant accounts driving exposure.

The piece notes how a contextual risk score can be used to sequence remediation—citing Orchid as a solution that builds an identity graph and ranks toxic combinations for fast, governance‑driven action.