Permission creep is the gradual buildup of access rights that are no longer needed. It happens when users change roles, temporary access is left in place, groups are nested, or inherited permissions are added without later cleanup. Over time, an account may gain far more reach than its current job requires.
In cyber security, permission creep matters because it quietly breaks least privilege. A compromised account with excessive rights can read sensitive files, modify data, or move laterally without needing to bypass technical controls. Insiders and stale accounts can create the same risk. In file-share environments, the problem is often hidden inside share permissions, filesystem permissions, and group membership, so effective access is harder to see than the settings administrators remember changing.
Defenders reduce permission creep through recurring access reviews, strong ownership of shared data, audit logs, and removal of unused or inherited rights. Automation can help find stale permissions, but policy and review are what keep access aligned with business need.