A privilege review is a check of high-level user accounts, roles, and permissions after a suspected security event. It looks for who can administer systems, read sensitive data, reset passwords, create new accounts, or approve access. Security teams compare current privileges against approved baselines to spot unusual changes, overbroad access, or accounts that should have been removed.
This matters because attackers often target privileged accounts to expand control, disable defenses, or exfiltrate data. In a real incident, a privilege review can reveal stolen admin credentials, a newly added operator account, or excessive access granted through misconfiguration. Defenders use it to confirm whether an alert is limited to a single user or has reached critical systems, and to decide whether to rotate credentials, revoke access, and harden account controls.