Cybersecurity data from the first half of 2026 points to a clear shift in how attackers are gaining access to companies: identity compromise, phishing and social engineering are increasingly being used to bypass traditional software-focused defenses.
The trend is reinforced by recent incident data. Palo Alto Networks’ Unit 42 found that identity weaknesses played a material role in nearly 90% of its incident-response investigations, while 65% of initial access in its case data involved identity-based techniques.
A separate weekly analysis covering September 7–13 found that four of five highlighted incidents involved a compromised credential, session or trusted-looking request rather than a novel attack technique.
The message for security teams is straightforward: attackers increasingly do not need to break the software if they can convince the company to let them in.
What Is Changing?
Traditional security programs have often focused heavily on vulnerabilities in operating systems, applications and network infrastructure.
Those vulnerabilities remain important. Actively exploited software flaws can still provide attackers with powerful access.
But identity-based attacks offer another route.
Instead of exploiting a vulnerability, an attacker may:
- steal an employee's password
- purchase compromised credentials
- steal browser session tokens
- use adversary-in-the-middle phishing to capture authentication
- impersonate IT or helpdesk staff
- trick employees into approving authentication requests
- compromise a supplier with legitimate access
- abuse an existing cloud or SaaS session
- convince an employee to register an attacker-controlled authentication method
Once the attacker has valid credentials, activity can look much more like legitimate business traffic.
Identity Has Become a Major Attack Surface
Unit 42's 2026 Incident Response Report found that identity-based techniques accounted for 65% of initial access in its incident-response case data.
Its breakdown included identity-related social engineering, credential misuse and brute force, and identity policy or insider-risk issues.
This is particularly important as companies move more infrastructure into cloud and SaaS environments.
The traditional network perimeter is no longer the only boundary that matters.
A single identity can potentially provide access to:
- Microsoft 365
- VPNs
- cloud consoles
- SaaS applications
- internal applications
- source-code repositories
- customer databases
- administrative systems
- third-party services
An attacker who obtains that identity may therefore bypass several traditional security controls at once.
Recent Incidents Show the Pattern
The September 7–13 threat landscape provides several examples.
In one case, attackers obtained credentials from a third-party vendor and used them to access a healthcare company's API. In another, compromised credentials belonging to a local law-enforcement user were used to access a state-level driver database.
A separate incident involving Revolut demonstrated a different form of identity abuse: attackers impersonated a legitimate government authority and persuaded employees to release sensitive customer information. The company's systems themselves were not technically breached.
Microsoft has also documented active cloud intrusions in which social engineering was followed by stolen credentials, new attacker-controlled authentication methods, cloud reconnaissance and data collection.
These incidents have an important common feature: trust was abused.
Why Stolen Credentials Are So Valuable
Software exploitation often requires an attacker to discover a vulnerable system, understand the vulnerability, develop an exploit and overcome additional security controls.
A valid credential can eliminate several of those steps.
Once authenticated, an attacker may already appear to be:
a legitimate employee using a legitimate account from a legitimate service.
That makes detection more difficult.
The attacker may also inherit permissions that were never intended to be used outside the employee's normal duties.
Unit 42 found that 99% of the cloud identities it analyzed had excessive permissions, including permissions that had not been used for extended periods.
This creates a dangerous combination:
stolen identity + excessive privileges = rapid expansion of access.
MFA Helps — But It Is Not the End of the Problem
Multi-factor authentication remains an important defensive control, but modern identity attacks increasingly target the authentication process itself.
Attackers can attempt to steal authenticated sessions, abuse OAuth permissions, manipulate MFA enrollment or use adversary-in-the-middle techniques to capture authentication material.
Microsoft recently documented campaigns in which attackers attempted to establish persistence by registering an authentication method under their own control after compromising an identity.
This means companies need to monitor more than just successful logins.
Security teams should also monitor:
- new MFA methods
- newly registered devices
- unusual OAuth applications
- suspicious session activity
- impossible or unusual login patterns
- privilege changes
- unusual cloud API activity
- password and recovery-method changes
- abnormal access to sensitive applications
What Companies Should Do
Identity security needs to become part of the core cyber-resilience strategy.
✅ Enforce phishing-resistant authentication
Where practical, use hardware-backed or phishing-resistant authentication methods rather than relying solely on passwords and traditional MFA prompts.
✅ Reduce excessive privileges
Regularly review permissions across users, service accounts and cloud identities.
If an account does not need administrative access, it should not have it.
✅ Monitor authentication changes
Alert on new MFA devices, passkeys, recovery methods, OAuth applications and unexpected privilege changes.
✅ Protect privileged accounts
Administrative identities should have stronger controls, separate credentials and tightly restricted access paths.
✅ Secure third-party access
Vendor accounts and integrations should use the minimum permissions required, short-lived credentials where possible and continuous monitoring.
✅ Train employees for impersonation attacks
Employees should understand that an attacker does not necessarily need to send an obvious phishing email.
The request may come through Teams, SMS, a phone call, a helpdesk interaction or even a seemingly legitimate government or business request.
✅ Prepare for compromised credentials
A password reset alone may not be sufficient.
Incident-response procedures should include revoking active sessions, reviewing MFA methods, removing malicious OAuth grants, checking forwarding rules and investigating privilege changes.
Final Thoughts
The modern corporate perimeter increasingly begins with an identity.
Attackers do not always need to find a vulnerable server or deploy sophisticated malware. Sometimes they only need a convincing message, a stolen session, a compromised vendor account or an employee who trusts the wrong request.
Cyber resilience must protect identities with the same intensity traditionally applied to software vulnerabilities. Strong authentication, least privilege, continuous identity monitoring and rapid response to compromised credentials are now fundamental security controls.
