33.6% of security leaders pointed to failing to remove unnecessary privileges as a common misstep in privileged access management.