If the primary concern is adversaries obtainingadministrator or elevated privileges, the first Cloud Identity Analyzer category to review isPrivilege Escalation. This category focuses on techniques and misconfigurations that allow attackers to gain higher-level permissions than initially granted.

Privilege escalation in cloud environments often involves overly permissive IAM roles, abuse of service principals, misconfigured trust relationships, or exploitation of identity federation mechanisms. CrowdStrike Cloud Identity Analyzer maps these behaviors to established attack frameworks and highlights identities that could be abused to gain admin-level access.

Other categories address different stages of the attack lifecycle.Executionfocuses on running malicious actions,Persistenceon maintaining access, andDefense Evasionon hiding activity. While all are important, privilege escalation represents the most direct path to full environment compromise.

Therefore, the correct starting point isPrivilege Escalation.