Run Remediation Campaigns

Use Privilege Zones to create bounded remediation campaigns with clear scope, ownership, and progress tracking.

Privilege Zones can support time-boxed remediation campaigns. A campaign zone is useful when a team needs to focus on a specific risk area, audit concern, executive priority, or application environment.

The zone can be used to create focus, drive remediation, and measure progress. After the campaign, the team can decide whether to keep the zone for ongoing monitoring or move to the next priority.

Scenario

A security team receives an audit finding related to privileged access into a sensitive application environment. The organization does not yet have a complete enterprise tiering model, but it needs to show progress quickly.

The team creates a Privilege Zone around the systems in scope for the finding. The zone is used to identify unexpected control paths, prioritize remediation, and report progress during the campaign.

What this can reveal

• Unexpected administrative paths into the scoped environment
• Overly broad groups that need to be reduced
• Service accounts that create hidden control paths
• Ownership gaps between application, IAM, endpoint, and infrastructure teams
• Progress over time as attack paths are removed

Why this works

A campaign zone gives teams a bounded problem to solve. It reduces the pressure to model the entire enterprise before taking action. It also creates a practical way to communicate progress to leadership, audit teams, or application owners.

Suggested workflow

1. Define the campaign objective.
2. Select the assets in scope.
3. Create a zone around those assets.
4. Review findings and identify the highest-value remediation actions.
5. Assign remediation owners.
6. Track reduction in attack paths over the campaign period.
7. Decide whether the zone should remain permanent or be replaced by the next campaign zone.

Example campaign objectives

• Reduce attack paths into a payment environment
• Validate access into a clinical application
• Clean up administrative access to production infrastructure
• Prepare for an audit or remediate audit findings
• Reduce exposure before a major application migration
• Validate segmentation after a restructuring or acquisition

Starter Cypher queries

These example Cypher queries help you identify candidate objects for zones and labels during discovery, trials, and early implementation.

Review and tune these queries before using them as production Privilege Zone rules.

Migration or acquisition campaign discovery

MATCH (n)
WHERE toUpper(coalesce(n.name, '')) CONTAINS 'LEGACY'
   OR toUpper(coalesce(n.name, '')) CONTAINS 'MIGRATION'
   OR toUpper(coalesce(n.name, '')) CONTAINS 'ACQUIRED'
   OR toUpper(coalesce(n.name, '')) CONTAINS 'OLD'
RETURN n
LIMIT 1000

Audit or compliance campaign discovery

MATCH (n)
WHERE toUpper(coalesce(n.name, '')) CONTAINS 'SOX'
   OR toUpper(coalesce(n.name, '')) CONTAINS 'PCI'
   OR toUpper(coalesce(n.name, '')) CONTAINS 'HIPAA'
   OR toUpper(coalesce(n.name, '')) CONTAINS 'AUDIT'
   OR toUpper(coalesce(n.name, '')) CONTAINS 'COMPLIANCE'
RETURN n
LIMIT 1000

Review immediate inbound relationships to campaign assets

// Replace Tag_Campaign with your campaign zone's tag label.
MATCH p=(s)-[r]->(t:Tag_Campaign)
WHERE NOT (s:Tag_Campaign)
RETURN p
LIMIT 1000

Review multi-hop paths into campaign assets

// Replace Tag_Campaign with your campaign zone's tag label.
MATCH p=(s)-[:AD_ATTACK_PATHS*1..]->(t:Tag_Campaign)
WHERE NOT (s:Tag_Campaign)
RETURN p
LIMIT 1000

Guidance

Campaign zones work best when paired with clear ownership and a defined time horizon. The zone creates visibility, but remediation still depends on the right teams taking action.

Key takeaway

Privilege Zones can turn broad identity risk into a focused remediation campaign with clear scope, ownership, and measurable progress.