Identity Is Where Attackers Get In

The Decision in Front of You

Security budgets still go mostly to stopping malicious software and patching servers. The evidence now says most attackers skip both. They sign in.

Verizon's 2025 Data Breach Investigations Report, built from more than 22,000 incidents and 12,195 confirmed breaches, found credential abuse was the leading initial access vector at 22%, ahead of exploited vulnerabilities at 20% ¹. Microsoft's Digital Defense Report 2025 calls identity "the primary control plane" for defense and found that 52.2% of intrusions through valid accounts went on to steal further credentials, so one stolen login tends to become many ³.

The decision is whether to run identity as one program with an owner, a budget and board metrics, or leave it as settings spread across a dozen teams. This paper covers the accounts themselves, for people and machines. Patching and shared passwords, VPN appliances, and payment fraud by email have their own papers in this series.

What's Happening

Attackers log in instead of breaking in

Coverage of Microsoft's 2025 report says identity-based attacks rose 32% in the first half of 2025, and 97% of them were password spraying or brute force, guessing common passwords across many accounts ⁴. These are cheap attacks. They fail against any account that requires a second factor attackers cannot replay.

Infostealer malware supplies the rest. Verizon's analysis of infostealer logs found that 46% of compromised systems holding corporate logins were unmanaged devices, most likely personal computers used for work ². When Verizon matched those logs against the victims named by ransomware groups in 2024, 54% of the victims had their domains in the credential dumps and 40% had corporate email addresses among the stolen credentials ².

Third parties widen the exposure. Breaches involving a third party doubled to 30% in the 2025 report, and the median time to fix secrets leaked in a public GitHub repository was 94 days ¹².

Machine identities outnumber people

Every integration, script, pipeline and AI agent signs in with something: a service account password, an API key, a certificate, an OAuth token granted to a connected app. A 2025 survey of 2,600 security decision makers in 20 countries, sponsored by the identity vendor CyberArk, estimated 82 machine identities for every person, and found that 42% of machine identities had privileged or sensitive access ¹⁸. In the same survey, 88% of respondents said their definition of a privileged user covered humans only ¹⁸.

These credentials cannot use MFA and rarely expire. Microsoft's 2025 report adds AI agents to the same problem and recommends scoped credentials and least privilege for them ³.

The standards have moved

CISA calls phishing-resistant MFA, meaning FIDO security keys, passkeys and smart cards, "the gold standard" ⁵. App codes can be relayed through a fake login page, and text messages can be stolen through SIM swaps ⁵. CISA asks administrators and other high-value targets to move first ⁵.

NIST finalized SP 800-63-4, its Digital Identity Guidelines, in July 2025 ⁷. Its authentication volume, SP 800-63B-4, requires services at the second assurance level to offer a phishing-resistant option, accepts synced passkeys there, and restricts text and voice codes ⁶⁷. It drops forced password changes and complexity rules in favor of length and a check against known compromised passwords ⁶. Every account recovery must trigger a notification to the account holder ⁶.

Four Cases, 2024 to 2025

M&S, April 2025. On April 17, 2025, attackers impersonated an M&S employee and persuaded a third party to reset that employee's password ⁹. Chairman Archie Norman told a UK parliamentary sub-committee the entry came through "sophisticated impersonation" involving a third party, reported to be its outsourced help desk ⁹. The attackers then encrypted servers with DragonForce ransomware ⁹. Online orders stopped for weeks ¹⁰. M&S had warned in May the attack could cost £300 million; in November it put direct costs at about £136 million, against an insurance claim of up to £100 million ¹⁰. The lesson: a password reset over the phone is an authentication event, and it was the weakest one M&S had.

Co-op, April 2025. Sources told BleepingComputer that attackers used social engineering to reset an employee's password at the Co-op, then stole the Active Directory database that holds every user's password hash ¹¹. The chief executive confirmed that data on all 6.5 million members was taken ¹¹. Co-op estimated £206 million in lost sales and an £80 million hit to operating profit in the six months to July 5, 2025, and it had no dedicated cyber insurance ¹². CISA's July 2025 update on Scattered Spider, the group reported to be behind both attacks ⁹¹¹, describes the same method: callers pose as employees, ask the help desk to reset passwords and move MFA to a device the attacker holds ⁸.

Microsoft, January 2024. The Russian intelligence group Microsoft tracks as Midnight Blizzard used a low-volume password spray to take over a legacy, non-production test tenant account that had no MFA ¹³. From there it found a legacy test OAuth application with elevated access to Microsoft's corporate environment and used it to grant itself access to corporate mailboxes ¹³. No cost has been published. Forgotten test accounts and test applications carried real permissions.

Salesloft Drift, August 2025. Between August 8 and at least August 18, 2025, a group Google tracks as UNC6395 used stolen OAuth tokens from the Salesloft Drift chat integration to export large volumes of data from customers' Salesforce instances ¹⁴. The attackers then searched the stolen records for AWS keys, passwords and Snowflake tokens to reach further systems ¹⁴. No password was stolen and no MFA prompt was bypassed, because the connected app already had access. Google advised treating every Drift-connected token as compromised ¹⁴.

The best-known 2024 cases, covered in this series' paper on patch debt and shared passwords, fit the pattern: Snowflake customer accounts entered with old infostealer passwords and no MFA ¹⁶, and a Change Healthcare remote access portal that "did not have multifactor authentication" ¹⁷.

Why the Usual Approach Fails

Identity has no single owner. HR creates the person, IT creates the account, application owners grant access, developers create service accounts and API keys, and the help desk resets everything. Nobody sees the whole account. At M&S and the Co-op the gap was the reset process ⁹¹¹, and at Microsoft a test tenant outside production controls ¹³.

MFA gets reported as a percentage of accounts enrolled. That number counts text messages and push prompts as equal to security keys, though CISA ranks them far apart ⁵. It also excludes the accounts that matter most: break-glass administrator accounts, legacy protocols that bypass MFA, and the machine credentials that cannot use it.

Administrator rights are standing, so one stolen admin login reaches everything at once. Microsoft's 2025 report says attackers commonly exploit excess privileges and standing access ³.

Machine identities sit outside the review cycle. Access reviews ask managers to confirm what their people can reach. Service accounts and OAuth grants have no manager, so they are skipped ¹⁴¹⁵.

Offboarding is a ticket. IT disables the main directory account, while local application accounts, SaaS logins outside single sign-on and API keys the person created survive.

The Framework: Five Doors

Every account in the business enters through one of five doors. Each door needs an owner, a control and a number the board can read. The model treats people and machines as the same problem: anything that can sign in is an identity.

flowchart LR
    A[Password stolen<br/>or reset by phone] --> B[Sign-in without<br/>phishing-resistant MFA]
    B --> C[More credentials<br/>harvested]
    C --> D[Standing admin rights<br/>or broad app tokens]
    D --> E[Data theft<br/>or ransomware]

Start sign-in work with administrators and the finance staff who release payments. Synced passkeys satisfy NIST's second assurance level, so most staff can use a phone or laptop they already have ⁶⁷.

For machines, the first job is a list: what each credential reaches, who owns it, when it was last rotated and last used. Anything without an owner is disabled after notice. Anything holding "full" access to a SaaS platform is cut back to what it uses, as Google recommended after Drift ¹⁴.

For recovery, the help desk should never reset a password or move MFA on facts an attacker can research, such as an employee number or a manager's name. The notification NIST requires after every recovery gives a real employee the chance to report a reset they did not request ⁶. Outsourced desks get the same procedure written into the contract, with call recordings and audit rights.

Costs, Risks, and Tradeoffs

Consider an illustration, the author's estimate. At an assumed $50 per hardware key and two keys per person, keys for 50 administrators cost $5,000, and for all 1,000 staff of a mid-size company $100,000. Most staff can use built-in passkeys instead. The larger costs are an identity governance tool, a secrets vault, help desk time per verified reset, and engineering time to move service accounts into the vault. Set those against the M&S direct costs of about £136 million and the Co-op's £80 million half-year profit hit ¹⁰¹².

How to Act

Questions to Ask Your Team

1. Who owns identity across HR, IT, the help desk and developers, and who reports on it to us?
2. What share of staff sign-ins use security keys or passkeys, and how many accounts can still sign in with a password alone?
3. How many people hold administrator rights right now, and how many of them are using those rights today?
4. If someone calls the help desk claiming to be our CFO with a new phone, what exactly happens, and does our outsourced desk follow the same script?
5. How many service accounts, API keys and connected apps do we have, and how many have no named owner?
6. Which third-party apps hold tokens into our email, CRM or file storage, and with what scope?
7. When someone left last month, how long did it take to remove every account and key they held?
8. Do any test, legacy or acquired environments sit outside our normal sign-in rules?

Closing

Attackers now get in by signing in, with a stolen password, a reset talked out of a help desk, or a token nobody remembered issuing. The 2025 retail attacks began that way. Make identity one program with one executive owner. Fund phishing-resistant sign-in, time-limited administrator access, an owned and rotated inventory of machine credentials, help desk resets that a caller cannot talk past, and same-day removal for leavers. Then put the five measures in front of the board every quarter.