Attackers aren't breaking in anymore. They're logging in. Here's why identity has become the primary attack surface and what it takes to secure it.
TL;DR: Most businesses are still securing the building while attackers are copying the keys. Darktrace's 2026 Annual Threat Report found that nearly 70 percent of incidents in the Americas start with stolen or misused accounts, not exploited software. The perimeter didn't disappear overnight, but it's no longer where the fights are happening. Identity is. And the organizations that haven't updated their security strategy to reflect that are defending the wrong thing.
Think about the last time you realized you'd lost track of who had a key to something. Not because anything went wrong, but just because enough time had passed and enough people had come and gone that you genuinely couldn't account for every copy anymore. The locks still work. That's not really the point.
Business credentials work the same way. Former employees whose accounts were never fully closed out. Vendors with access that made sense two years ago and hasn't been revisited since. Service accounts created for a project that wrapped up and then just stayed active. None of it feels urgent until someone uses one of those keys to walk in somewhere they shouldn't be.
Nearly 70 percent of incidents in the Americas start with stolen or misused accounts, according to Darktrace's 2026 Annual Threat Report. Not sophisticated exploits. Not malware that slipped past the firewall. A valid credential, obtained one way or another, used to log in like a normal user and move around until someone notices, which often takes longer than anyone wants to admit.
Most security strategies were built for a different kind of attack. Firewalls and network monitoring make a lot of sense when the threat is someone trying to break through the wall. They make less sense when the threat is someone who already has a key. This post covers what identity security actually involves and why it's become the most important thing most businesses haven't fully addressed yet.
Not long ago, securing a business meant securing the network. You built a perimeter, put a firewall at the edge, monitored what came in and out, and kept the sensitive stuff behind it. That model made sense when the work happened inside a building on company-owned hardware connected to a company-owned network.
Then the work moved. Email went to Microsoft 365. Files went to SharePoint and Google Drive. Applications went to the cloud. Employees started working from home, from client sites, from anywhere with decent Wi-Fi. And the perimeter that all those security investments were built to defend gradually stopped existing.
What replaced it is identity. Every cloud platform, every SaaS application, every remote access point is protected by credentials. A username and a password, maybe a second factor. That login screen is the new front door, and it's reachable from anywhere in the world by anyone who has the right credentials.
Attackers figured this out before most defenders did. Unit 42's 2026 Global Incident Response Report found that identity weaknesses were a determining factor in more than half of all intrusions investigated in 2025. The same research found that 99 percent of cloud identities had excessive permissions, including access that hadn't been used in 60 days or more. Overpermissioned, unreviewed, and in many cases forgotten accounts are the gaps attackers walk through. Not because they're sophisticated. Because nobody was watching.
Most people hear "MFA" and assume the identity problem is solved. Turn on two-factor authentication, and stolen passwords stop working. That was true for a while. It's less true now.
There's a category of malware called infostealers, designed specifically to harvest credentials from infected devices. Not just usernames and passwords, but active session cookies, the tokens your browser stores after a successful login to confirm you've already authenticated. When an infostealer steals a valid session cookie, an attacker can clone that browser session and inherit full access to the account. MFA never fires, because as far as the system is concerned, authentication already happened. The door was opened legitimately. They're just walking through it.
The scale of this problem in 2025 was significant. Flashpoint and DeepStrike documented more than 1.8 billion credentials stolen from roughly 5.8 million infected devices, an 800 percent surge over recent years. Of those, 276 million included active session cookies that enable MFA bypass entirely. And according to Verizon's 2025 Data Breach Investigations Report, 54 percent of ransomware victims had their domain credentials appear in stealer logs before the attack hit. The infostealer isn't the end of the story. It's usually the beginning.
The practical implication for businesses is uncomfortable but clear. MFA is still essential and absolutely worth having. It stops a lot of attacks. It just doesn't stop this one. The defenses that address session hijacking go beyond authentication: endpoint security that catches infostealer infections before they complete, session monitoring that flags unusual access patterns after authentication, and rapid response when credentials appear in breach data. The lock on the front door matters. So does knowing when someone's already inside.
Not all credentials are worth the same amount to an attacker. A standard employee account gets you into email and maybe a few shared drives. An executive account, a finance manager's account, or an IT administrator's account gets you somewhere much more interesting: broader access, higher trust relationships, and in many cases the ability to authorize things, move money, or make changes the attacker actually cares about.
Attackers know this and allocate their effort accordingly. Spear phishing, which is targeted and personalized rather than generic, accounts for 65 percent of successful phishing attacks despite representing only 0.1 percent of total phishing volume. The extra effort pays off. Senior executives are 23 percent more likely to fall victim to AI-driven personalized attacks than standard employees, largely because they receive a higher volume of targeted attempts and operate in environments where urgency and authority are constant factors. Finance and accounting staff are three times more likely to be targeted than employees in other departments, for obvious reasons.
The underlying vulnerability is the same across all of these: accounts carrying more access than the role actually requires. An executive who needs to read financial reports doesn't need write access to the billing system. A vendor integration that pulls order data doesn't need to see HR records. When those accounts get compromised, the damage is determined entirely by how much access was attached to them. Scope the access tightly, and a compromised account is a contained problem. Leave it broad, and it's a very bad week.
A periodic access review that asks "does this account still need this permission?" sounds like the kind of thing that always gets pushed to next quarter. In practice, it's one of the highest-return security activities available, costs almost nothing compared to the alternative, and consistently surfaces problems nobody knew were there until someone looked.
Here's the honest version: identity security isn't one thing. It's a handful of controls that work together to make stolen credentials less useful, limit how far an attacker gets when something does go wrong, and give you enough visibility to catch problems before they turn into incidents. None of it is exotic. Most of it just requires someone to actually set it up and maintain it.
MFA on every account is the starting point, and every account really does mean every account. Email, cloud apps, VPN, admin consoles, the third-party platform your team uses to manage projects. Partial MFA coverage is a gap attackers look for on purpose. One login page without a second factor is all it takes, and passwords are genuinely the cheapest thing available on the dark web right now.
Conditional access is the next layer. Instead of just asking for a second factor, it looks at context: familiar device, recognized location, reasonable time of day. A login from someone's usual laptop in Portland at 9 a.m. looks very different from a login from an unknown device overseas at 3 a.m. Both might have valid credentials. Conditional access is what makes that distinction matter.
Session monitoring is where most organizations have the biggest gap. As we covered earlier, authentication isn't the only moment of risk anymore. Unusual behavior after login, moving between systems that don't normally connect, bulk data access that doesn't match any normal pattern: these are the signals that a legitimate session may have been taken over. You can't catch what you're not watching for.
And offboarding needs to be treated like the security event it actually is. Access revoked the day someone leaves, not whenever someone gets around to it. Every account, every platform, every integration that person ever touched. The accounts that linger longest are almost always the ones nobody remembers are there, right up until someone does.
Identity is one piece of a broader security strategy; for the full framework on how it fits together, see our previous post The Cybersecurity Tools Are Fine. The Strategy Is What's Missing.
If you're running a business in Oregon, Washington, or California, identity security has a legal dimension that's worth understanding before something forces the conversation.
Oregon's Consumer Privacy Act has been in effect since July 2024, and it requires businesses handling personal data of Oregon residents to have real security controls in place: access management, MFA, documented practices. What changed on January 1, 2026, is that the Oregon AG no longer has to warn you before taking action. No 30-day cure period, no heads up. They can go straight to a lawsuit or a civil investigative demand. Penalties run up to $7,500 per violation, and each affected consumer counts separately. If a data exposure touches a few thousand Oregon residents, the math gets uncomfortable quickly.
Washington's My Health MY Data Act covers businesses handling consumer health data, and unlike a lot of privacy laws, it includes a private right of action. That means it's not just regulators you need to worry about. Plaintiffs' attorneys have standing too. Washington state also requires annual security awareness training for agencies and contractors, which tends to set the expectation bar for anyone doing business in that ecosystem.
California's CCPA and CPRA are the most comprehensive frameworks on the West Coast, with detailed requirements around access controls, data governance, and breach notification. Most businesses with any California footprint are already covered, whether they know it or not.
The practical point is this: identity controls aren't just a security best practice for West Coast firms. They're the documented evidence that the organization took reasonable steps to protect the data it's responsible for. When regulators or plaintiffs ask what you did, "we had MFA on most accounts and reviewed access when we thought about it" is not the answer you want to give.
Most businesses aren't getting breached because their firewall failed. They're getting breached because someone found a key. A former employee whose account was never closed. A vendor with access that made sense two years ago and was never revisited. A credential harvested by malware that ran quietly on a laptop for three weeks before anyone noticed. The perimeter didn't fail. The keys just got out.
The good news is that identity security, done right, is one of the highest-return investments in the security stack. MFA, conditional access, least privilege, regular access reviews, and session monitoring don't require a massive budget or a dedicated security team. They require someone to own them and actually follow through. The organizations that do this consistently are significantly harder targets than the ones that don't, and the gap between those two groups keeps widening.
Heroic Technologies works with professional services firms, law firms, and mid-sized businesses across Oregon, Washington, and California. They've spent 14-plus years building security programs for organizations that hold sensitive, regulated, and privileged data, which means identity security isn't a new conversation for their clients. It's the one that comes up in almost every assessment they do.
When it comes to identity specifically, that means auditing who actually has access to what, tightening the controls that matter most, and building the monitoring that catches what authentication alone misses.
If you're not sure your organization's identity posture is where it needs to be, that's worth finding out sooner rather than later. Reach out to Heroic Technologies and let's take a look at what's in your environment before someone else does.
1. If we already have MFA, are we protected from identity-based attacks?
MFA stops a lot of attacks but not all of them. Infostealer malware harvests active session cookies after a successful login, allowing attackers to clone an authenticated session and bypass MFA entirely. The defenses that address this go beyond authentication: endpoint security that catches infostealers before they complete, session monitoring that flags unusual behavior after login, and rapid response when credentials surface in breach data.
2. How do we know if former employees still have active accounts in our environment?
You probably don't, which is the problem. A structured access audit pulling from every platform, not just the main directory, is usually what surfaces these. Cloud applications, third-party integrations, and project management tools are where lingering accounts tend to hide longest. The fix is a documented offboarding process that treats access revocation as a defined security event on the last day of employment, not a checklist item someone gets to eventually.
3. Do Oregon and Washington businesses have specific legal requirements around identity controls?
Yes. Oregon's Consumer Privacy Act requires reasonable safeguards, including access controls and MFA, for businesses handling personal data of Oregon residents. As of January 1, 2026, the Oregon AG can proceed directly to enforcement without notice, with penalties up to $7,500 per violation. Washington's My Health MY Data Act imposes similar requirements for health data and includes a private right of action. California's CCPA and CPRA set the most comprehensive framework on the West Coast. For businesses operating across all three states, identity controls aren't optional.