Managing identity sprawl

The evolving threat landscape has placed identity governance at the center of cybersecurity, according to a pair of reports, meaning that organizations should prioritize identity management as a way to protect sprawling computer networks from under-the-radar intrusions.

A Cloudflare report and a PwC report both emphasize the need for companies to do a better job of monitoring user behavior and scanning for suspicious network activity.

The rise of AI only makes identity governance even more important, researchers wrote, as the technology helps hackers improve their impersonation tactics.

In the past, intrusion prevention primarily took the form of vulnerability management, with intrusion detection focused on prowling for exploitation of digital flaws or suspiciously repetitive login attempts. Today, security researchers say, identity abuse makes it easier for hackers to break into a system without tripping alarms.

The most familiar identity-compromise tactics involve stealing passwords by phishing users or scanning databases of leaked credentials. But as Russia’s SolarWinds supply-chain attack demonstrated, sophisticated attackers can also forge authentication tokens and bypass traditional login processes entirely.

“Adversaries across a wide range of motivations are increasingly choosing to log in rather than break in, exploiting credentials, session tokens, and federated access to bypass traditional perimeter defences,” PwC researchers wrote in their annual threat report, which declared that “identity is the key battleground” in the modern threat environment.

Of course, token forgery is rarely necessary, as social-engineering attacks regularly yield credentials that can help hackers establish footholds in target networks and move laterally from there. Other intrusions — like those of the Scattered Spider cybercrime gang — involve tricking IT help desks into handing over sensitive data. Meanwhile, North Korea has perfected another form of identity-based attack by convincing Western businesses to hire its operatives for remote IT jobs.

“As organizations expand their SaaS ecosystems and cloud dependencies, the attack surface is widening — with a single compromised identity capable of unlocking cascading access across entire environments,” PwC said. “Treating identity governance as a strategic, board-level priority — not a technical checkbox — will be critical to staying ahead of the field.”

Cloudflare’s annual Security Signals report also spotlights the importance of identity management. Of all the email-based threats that the company detected last year, 19% of them involved identity deception, making that the second most commonly observed threat category after malicious links.

Identity-based attack campaigns “exploit trust signals rather than technical vulnerabilities,” Cloudflare noted.

The company echoed warnings that AI is helping hackers improve the quality of attacks.

“As AI lowers the cost of producing convincing, personalized deception,” researchers wrote, “governance must extend beyond model oversight to authentication, identity integrity, and decision traceability.”

Identity management isn’t just for humans anymore. Cloudflare also encouraged companies to prioritize identity governance for their AI agents.

“Non-human identities — AI agents, service accounts, bots — now outnumber human users by orders of magnitude,” the company said in its report. “Yet most enterprises still govern identity as if people are the primary actors.”

Identity-related risks are the biggest danger facing enterprises’ cloud environments, according to a report from ReliaQuest.

Some 44% of valid alerts from cloud security tools “were rooted in identity-related weaknesses,” ReliaQuest said, while 33% of all alerts related to identity. Hackers prefer identity-based attacks because they rely on credentials available for cheap on the dark web, they can evade many detection tools and there are so many identities ripe for impersonation.

As businesses migrate more of their assets to cloud platforms, identity management has risen to the top of the list of important security practices. Many sophisticated hackers use stolen credentials to bypass security protections and establish footholds in their targets’ networks, making strong access controls an imperative for defenders.

“Organizations must realign their security strategies to treat identity as the true modern perimeter,” ReliaQuest’s report said. “This shift requires a proactive stance that starts beyond the boundaries of the network.” The security firm recommended that organizations scan the dark web for compromised employee credentials using digital risk protection capabilities.

Managing privileges will also help organizations defeat identity-based attacks, according to the report. More than half of the confirmed identity-based alerts that ReliaQuest saw involved privilege escalation. Using legitimate credentials with unnecessarily broad privileges “is far stealthier than ‘noisy’ methods like running vulnerability scanners or executing exploit code for known CVEs, which are more likely to trigger alerts,” ReliaQuest said.

The security firm presented the dramatic statistic that “99% of cloud identities are over-privileged,” and it urged organizations using cloud platforms such as Amazon Web Services to lock down accounts that come preconfigured with broad access. According to ReliaQuest, companies should adopt a “zero standing privileges” model in which computer systems manage user permissions with just-in-time authentication that validates access requests on a case-by-case basis.

Identity-based attacks also challenge defenders because of the volume of data they must analyze to root out intruders. ReliaQuest highlighted this challenge when presenting the statistic about 33% of all alerts relating to identity.

“This dual burden — where identity is both the top cause of confirmed breaches and the noisiest source of alerts — overwhelms security teams and drives up operational costs,” the company said. “These alerts are particularly costly to triage because, while automated systems can message users for verification, security teams still need to manually assess whether the activity is benign or malicious, often relying on specific organizational risk policies.”

Sponsored content

By Okta

We've entered the era of AI agents. Agents are the new application layer, running in production, handling data pipelines, security workflows, SaaS integrations, and operational tech. As business logic migrates from apps to agents, every risk becomes an identity problem: who's acting, under what authority, with what lineage, and how fast can you revoke access when context shifts?

The answer isn't another control layer. It's IAM rebuilt for autonomy: one that evaluates context continuously, tracks delegation across domains, and gives developers the primitives to build secure agent workflows. Built on OpenID Foundation's agentic identity guidance and OWASP's non-human identity framework.

The Series

1. AI security: IAM delivered at agent velocity

Human-centric security models fail at machine speed. On July 18, 2025, an AI agent at Replit erased 1,206 executive records from a live database in seconds. While a typical app performs 50 operations per minute, AI agents execute 5,000. Consent-based models collapse under agent velocity. Policy-based authorization, enforced in real time, is the only viable path forward.

2. AI Security: When Authorization Outlives Intent

Delegated authority becomes a liability when credentials persist far beyond their intended scope. The Salesloft Drift breach in August 2025 compromised 700+ organizations via OAuth tokens that should have been revoked months earlier. With non-human identities now outnumbering humans 144 to 1, "authorization drift" has become a critical security gap.

3. AI Security: When Your Agent Crosses Multiple Independent Systems, Who Vouches for It?

No single identity provider spans every system your agent touches. With 69% of organizations expressing concerns about non-human identity attacks and AI agents operating at 5,000 operations per minute across multiple trust domains, federated identity must be verifiable and revocable in real time.

4. Control the Chain, Secure the System: Fixing AI Agent Delegation

Recursive delegation creates new attack surfaces. Recent security research shows the risks: Unit 42 disclosed the Agent Session Smuggling technique, Johann Rehberger demonstrated Cross-Agent Privilege Escalation, and EchoLeak (CVE-2025-32711) exposed how tool-use agents can be manipulated. All exploit the same gap: permissions that don't narrow at each hop.

5. AI Security: When Agents Control Physical Systems, IAM Becomes Safety Infrastructure

AI agents now control systems that regulate pressure, direct machinery, and manage chemical flows. Claude Code autonomously breached chemical manufacturers. A calendar invite hijacked Gemini to control smart home devices. The JLR credential compromise shut down factories for five weeks, and that was human attackers. Imagine that lateral movement at machine speed. When software moves physical systems, IAM isn't IT infrastructure. It's what prevents the explosion.

6. AI Security: When Agents Serve Shared Workspaces, Authorization Must Follow the Audience

Authorized retrieval. Unauthorized recipients. That's the permission intersection problem. Four critical vulnerabilities (CVSS 9.3-9.4) hit Anthropic, Microsoft, ServiceNow, and Salesforce in 2025 with the same pattern: OAuth checked who could retrieve, but nobody checked who received the output. When agents operate in shared contexts, fine-grained authorization must compute the intersection of all recipients' permissions before data leaves the retrieval layer.

7. Identity and Authorization: The Operating System for AI Security.

Six failure modes. One root cause: identity and authorization systems that still treat agents like users. Deloitte's 2026 State of AI report found 73% of enterprise leaders cite security as their top AI risk, yet only 21% have a mature governance model for autonomous agents. This capstone maps every failure to Okta's Discover, Onboard, Protect, Govern framework and the five architectural properties that make agent security work.

All statistics and incidents are sourced in individual posts.

Hackers are using ransomware to accelerate the timeline for cyberattacks, moving on average four times faster than just a year ago, according to an incident response report by Palo Alto Networks. 

AI is being used for reconnaissance, phishing and scripting, and operational execution in many cases. In the most efficient attacks, groups exfiltrate data just 72 minutes after initial access. 

Identity is a primary element in attacks, showing up in 90% of incident response cases. Threat groups are increasingly using stolen identities and tokens to gain entry without triggering security warnings.  

“Once an attacker has legitimate credentials, they’re not breaking in, they’re logging in,” Sam Rubin, a senior vice president at Palo Alto Networks’ Unit 42, told Cybersecurity Dive. “When an adversary blends into normal traffic, detection becomes incredibly challenging for even mature defenders.”

The report is based on analysis of more than 750 incident response cases across the globe that involved Unit 42 analysts and researchers. 

The report analyzed how threat groups are using AI to operate with unprecedented speed and scale, running simultaneous attacks and taking advantage of known software flaws to go after vulnerable targets before those victims can take preventative measures. 

For example, attackers are now targeting vulnerabilities within 15 minutes of a CVE disclosure.

Hackers are also using AI to run reconnaissance and initial access attempts against hundreds of targets at the same time. 

The report shows attackers are abusing trusted integrations to launch attacks against software-as-a-service applications. Nearly one-quarter of incidents involved these types of attacks over the past year. 

These integrations provide legitimate, privileged access, making exploitation of these trusted connections more difficult to defend.

“This is a structural shift in supply chain risk that moves beyond vulnerable code to the abuse of trusted links,” Rubin said.

A coordinated, credential-based hacking campaign has been targeting Palo Alto Networks GlobalProtect services, as well as Cisco SSL VPNs, in a surge of mid-December 2025 attacks, according to findings by GreyNoise. 

The threat activity did not involve targeting of any vulnerabilities, but used automated scripted login attempts over two days. 

More than 1.7 million sessions were observed targeting Palo Alto Networks GlobalProtect and PAN-OS profiles over a 16-hour period, according to GreyNoise. More than 10,000 unique IPs were detected trying to log into GlobalProtect portals on Dec. 11.  

The targeted portals were located mainly in the U.S., Pakistan and Mexico, GreyNoise said. Almost all of the traffic originated from IP space associated with hosting provider 3xK GmbH, which indicates the activity used centralized, cloud-hosted infrastructure rather than widely distributed end-users.

Researchers saw a sharp increase in opportunistic brute-force login attempts targeting Cisco SSL VPNs on Dec. 12. Daily unique attacking IPs rose from a regular baseline of about 200 to 1,273 IPs. GreyNoise said much of the traffic hit its vendor-agnostic Facade sensors. This indicates the attacks were more opportunistic than targeted.

A spokesperson for Palo Alto Networks said the company was aware of the threat activity, noting the process involved “automated credential probing” and did not compromise its environment or exploit any vulnerabilities linked to the company.

“Our investigation confirms that these are scripted attempts to identify weak credentials,” a spokesperson for Palo Alto Networks told Cybersecurity Dive via email.

The Cisco attacks share tooling and infrastructure linked to the Palo Alto Networks attacks, according to GreyNoise.

Those same researchers on Dec. 2 warned about a surge in traffic involving more than 7,000 IPs targeting Palo Alto Networks GlobalProtect. A similar surge on Dec. 3 targeted SonicWall SonicOS API endpoints. 

GreyNoise previously warned about scanning activity over several months targeting Palo Alto Networks GlobalProtect, including a major surge in November. 

A spokesperson for Cisco was not immediately available for comment.

A suspected wiper attack against medtech giant Stryker has led much of the security community to examine the role of Microsoft Intune. 

Stryker, a Portage, Mich.-based specialist in surgical equipment, suffered a cyberattack in March that affected thousands of mobile devices and other systems. 

The company, in a regulatory filing, confirmed the attack impacted its Microsoft environment and warned in a customer update that its electronic ordering systems remain unavailable. 

An Iran-linked hacker tracked under the name Handala claimed credit for the attack, according to Check Point Research. The hacker claims to have stolen 50 terabytes of data and to have wiped information from thousands of servers and mobile devices in the process. 

Researchers from Halcyon told Cybersecurity Dive the Stryker attack impacted all phones and workstations with an Intune base-64 string. Intune is normally used to push software or manage devices that are base-64 encoded, according to researchers.

The payload included remote wipe commands, which were used to delete data on all affected devices, according to Halycon.

In order to conduct such an attack, a hacker would need to obtain Intune administrator or global administrator privileges, researchers said. 

MFA as a defense

Paddy Harrington, a senior analyst at Forrester, said the attack does not point to any inherent weakness in Microsoft Intune, but essentially utilizes living-off-the-land techniques to bypass existing security systems. 

Attacks using mobile device management platforms are not new and have been used to conduct significant attacks in recent years. Harrington points to a January attack against the European Commission and a 2020 attack against a multinational firm using a Cerberus banking Trojan. 

“Using MFA to access MDM/UEM can reduce the likelihood of a simple account takeover attack. And for destructive functions like wipe actions, Intune and other modern platforms have a multiaccount approval feature that ensures that no one person can make critical changes,” Harrington told Cybersecurity Dive.

Researchers from Palo Alto Networks Unit 42 would not comment on the specifics of the Stryker attack, but cited a March 6 report from Israel’s National Cyber Directorate about destructive wiper attacks targeting servers and workstations at several companies with the goal of deleting data, according to a blog post. 

In some of those attacks, hackers gained access to credentials or other information from legitimate users and weaponized that to gain initial access to systems, according to Unit 42’s blog post. 

Microsoft has thus far declined to comment on the incident, but a spokesperson told Cybersecurity Dive it would provide an update if any additional information became available.

Stryker has been working with third-party forensic experts to investigate the attack and the Cybersecurity and Infrastructure Security Agency has been investigating the attack as well.

An international coalition led by Microsoft and Europol has taken down the operations of Tycoon 2FA, a notorious phishing-as-a-service platform that helped cybercriminals gain access to millions of email accounts across the globe. 

Microsoft obtained a court order from the U.S. District Court from the Southern District of New York to seize 330 active domains used to back the core infrastructure of Tycoon 2FA.

“Taking this infrastructure offline cuts off a major pipeline for account takeovers and helps protect people and organizations from follow-on attacks such a data theft, ransomware, business email compromise and financial fraud,” Steve Masada, assistant general counsel at Microsoft’s Digital Crimes Unit, said in a blog post.

Tycoon 2FA, which had been active since 2023, grew into one of the largest phishing operations in the world. The attacks impacted more than 96,000 phishing victims globally since 2023. Microsoft said more than 55,000 of its customers were affected. 

The service operated as an adversary-in-the-middle phishing kit, harvesting usernames, passwords and session cookies from Gmail and Microsoft 365 accounts, according to a blog post from Proofpoint, which was part of the coalition. 

Tycoon 2FA had a widespread impact on businesses, healthcare providers and universities. More than 100 members of Health-ISAC were impacted, compromising the account credentials of staff members at these organizations. Health-ISAC was listed as a co-plaintiff on the court order.

“We saw firsthand how medical facilities were hit hardest,” Errol Weiss, chief security officer at Health-ISAC, told Cybersecurity Dive. “These attacks have tangible consequences, leading to diverted ambulances, disrupted hospital operations, and dangerous delays in patient care.”

Law enforcement agencies from the UK, Latvia, Poland, Spain and other parts of Europe participated in the operation, according to Europol.