Managing and securing identity sprawl

The evolving threat landscape has placed identity governance at the center of cybersecurity, according to a pair of reports, meaning that organizations should prioritize identity management as a way to protect sprawling computer networks from under-the-radar intrusions.

A Cloudflare report and a PwC report both emphasize the need for companies to do a better job of monitoring user behavior and scanning for suspicious network activity.

The rise of AI only makes identity governance even more important, researchers wrote, as the technology helps hackers improve their impersonation tactics.

In the past, intrusion prevention primarily took the form of vulnerability management, with intrusion detection focused on prowling for exploitation of digital flaws or suspiciously repetitive login attempts. Today, security researchers say, identity abuse makes it easier for hackers to break into a system without tripping alarms.

The most familiar identity-compromise tactics involve stealing passwords by phishing users or scanning databases of leaked credentials. But as Russia’s SolarWinds supply-chain attack demonstrated, sophisticated attackers can also forge authentication tokens and bypass traditional login processes entirely.

“Adversaries across a wide range of motivations are increasingly choosing to log in rather than break in, exploiting credentials, session tokens, and federated access to bypass traditional perimeter defences,” PwC researchers wrote in their annual threat report, which declared that “identity is the key battleground” in the modern threat environment.

Of course, token forgery is rarely necessary, as social-engineering attacks regularly yield credentials that can help hackers establish footholds in target networks and move laterally from there. Other intrusions — like those of the Scattered Spider cybercrime gang — involve tricking IT help desks into handing over sensitive data. Meanwhile, North Korea has perfected another form of identity-based attack by convincing Western businesses to hire its operatives for remote IT jobs.

“As organizations expand their SaaS ecosystems and cloud dependencies, the attack surface is widening — with a single compromised identity capable of unlocking cascading access across entire environments,” PwC said. “Treating identity governance as a strategic, board-level priority — not a technical checkbox — will be critical to staying ahead of the field.”

Cloudflare’s annual Security Signals report also spotlights the importance of identity management. Of all the email-based threats that the company detected last year, 19% of them involved identity deception, making that the second most commonly observed threat category after malicious links.

Identity-based attack campaigns “exploit trust signals rather than technical vulnerabilities,” Cloudflare noted.

The company echoed warnings that AI is helping hackers improve the quality of attacks.

“As AI lowers the cost of producing convincing, personalized deception,” researchers wrote, “governance must extend beyond model oversight to authentication, identity integrity, and decision traceability.”

Identity management isn’t just for humans anymore. Cloudflare also encouraged companies to prioritize identity governance for their AI agents.

“Non-human identities — AI agents, service accounts, bots — now outnumber human users by orders of magnitude,” the company said in its report. “Yet most enterprises still govern identity as if people are the primary actors.”

Identity-related risks are the biggest danger facing enterprises’ cloud environments, according to a report from ReliaQuest.

Some 44% of valid alerts from cloud security tools “were rooted in identity-related weaknesses,” ReliaQuest said, while 33% of all alerts related to identity. Hackers prefer identity-based attacks because they rely on credentials available for cheap on the dark web, they can evade many detection tools and there are so many identities ripe for impersonation.

As businesses migrate more of their assets to cloud platforms, identity management has risen to the top of the list of important security practices. Many sophisticated hackers use stolen credentials to bypass security protections and establish footholds in their targets’ networks, making strong access controls an imperative for defenders.

“Organizations must realign their security strategies to treat identity as the true modern perimeter,” ReliaQuest’s report said. “This shift requires a proactive stance that starts beyond the boundaries of the network.” The security firm recommended that organizations scan the dark web for compromised employee credentials using digital risk protection capabilities.

Managing privileges will also help organizations defeat identity-based attacks, according to the report. More than half of the confirmed identity-based alerts that ReliaQuest saw involved privilege escalation. Using legitimate credentials with unnecessarily broad privileges “is far stealthier than ‘noisy’ methods like running vulnerability scanners or executing exploit code for known CVEs, which are more likely to trigger alerts,” ReliaQuest said.

The security firm presented the dramatic statistic that “99% of cloud identities are over-privileged,” and it urged organizations using cloud platforms such as Amazon Web Services to lock down accounts that come preconfigured with broad access. According to ReliaQuest, companies should adopt a “zero standing privileges” model in which computer systems manage user permissions with just-in-time authentication that validates access requests on a case-by-case basis.

Identity-based attacks also challenge defenders because of the volume of data they must analyze to root out intruders. ReliaQuest highlighted this challenge when presenting the statistic about 33% of all alerts relating to identity.

“This dual burden — where identity is both the top cause of confirmed breaches and the noisiest source of alerts — overwhelms security teams and drives up operational costs,” the company said. “These alerts are particularly costly to triage because, while automated systems can message users for verification, security teams still need to manually assess whether the activity is benign or malicious, often relying on specific organizational risk policies.”

Sponsored content

By Okta

Ask any IT or security executive how many identity tools run across their enterprise, and you will likely hear a hesitant response. Single Sign-On (SSO) and Multi-Factor Authentication (MFA) live in one silo. Identity Governance and Administration (IGA) was added later. Privileged Access Management (PAM) came after an audit. Each point solution was deployed to address a specific need, but they were never designed to operate as a cohesive system.

Now ask that same leader how many AI agents or non-human workloads are accessing enterprise resources. The answer becomes even harder to pin down.

This fragmented approach to identity security has created a dual challenge: dangerous security blind spots and escalating operational drag. Modern threats do not respect domain boundaries, and attackers actively exploit the gaps between disconnected identity tools.

To quantify the economic and operational value of solving identity sprawl, Okta commissioned Forrester Consulting to conduct an independent Total Economic Impact™ (TEI) study. Modeling a composite enterprise with 9,000 employees and $3 billion in annual revenue, the study quantifies what happened when organizations transitioned from fragmented identity tools to a unified identity security fabric with Okta.

The Architectural Shift: Unifying the Core of Identity

An identity security fabric unifies core capabilities—including posture management, access management, identity governance, privileged access, device trust, threat detection and response, and orchestration and automation—into a shared architecture. Rather than stitching together siloed point solutions, a unified platform shares security signals in real time and enforces consistent policy, and responds to threats in real time,  across all user types, devices, and applications.

By closing the security gaps, security teams eliminate the manual cross-console scramble that occurs during an active incident.

Quantifying the Security Impact

The Forrester study found that adopting a unified identity security platform significantly strengthened the composite enterprise's defense posture:

• 90% reduction in the likelihood of an identity-related breach.
• 90% reduction in mean time to remediate identity-related attempted incidents.
   

As one fintech IAM staff engineer noted in the study: “A breach in our organization could cost up to $1 billion, and we are required to publicly disclose it. In a financial services environment, that level of exposure would have a significant reputational and business impact. Okta helps us reduce the risk of that happening.”

Reclaiming Operational Efficiency and Lowering TCO

Identity sprawl does not just increase risk, it consumes thousands of engineering and help desk hours maintaining integrations, processing routine access requests, and managing complex certification campaigns.

When the composite enterprise unified its IAM with Okta, the financial and operational benefits compounded rapidly:

• 216% ROI over three years with a payback period of less than six months.
• $15.5M in total financial benefits ($10.6M Net Present Value).
• 50% reduction in IAM support ticket volume by Year 3.
• $2.2M in SaaS cost savings over three years from eliminating redundant applications and reclaiming unused licenses
• 75% faster new app onboarding and 65% faster identity integration during M&A events.

Establishing Governance for the AI Era

As organizations rapidly deploy AI agents, non-human identities are expanding faster than traditional identity programs can track. According to recent industry research, 92% of enterprises use AI agents, yet over half have already experienced an AI-related security incident or close call.

A unified identity architecture provides the essential foundation to govern AI agents with the same rigor applied to human workforce identities:

1. Scoped access: Permissions are strictly limited to what each task requires
2. Traceable audit trails: Every action executed by an AI agent is logged and auditable
3. Immediate access revocation: Access is immediately revoked across all connected resources when an agent is decommissioned or behaves unexpectedly

Establishing robust identity controls today ensures enterprises can scale AI innovation securely without compounding technical debt or exposure.

Elevating Identity Security from Cost Center to Growth Enabler

Consolidating enterprise identity is no longer just an infrastructure cleanup project—it is a high-leverage business strategy. Unifying access management, identity governance, privileged access, and other identity security capabilities transforms identity security from a fragmented cost center into a resilient foundation for digital trust and agility.

Ready to evaluate the potential impact for your organization? Download the complete Forrester Total Economic Impact™ Study to review the full financial framework

Hackers are using ransomware to accelerate the timeline for cyberattacks, moving on average four times faster than just a year ago, according to an incident response report by Palo Alto Networks. 

AI is being used for reconnaissance, phishing and scripting, and operational execution in many cases. In the most efficient attacks, groups exfiltrate data just 72 minutes after initial access. 

Identity is a primary element in attacks, showing up in 90% of incident response cases. Threat groups are increasingly using stolen identities and tokens to gain entry without triggering security warnings.  

“Once an attacker has legitimate credentials, they’re not breaking in, they’re logging in,” Sam Rubin, a senior vice president at Palo Alto Networks’ Unit 42, told Cybersecurity Dive. “When an adversary blends into normal traffic, detection becomes incredibly challenging for even mature defenders.”

The report is based on analysis of more than 750 incident response cases across the globe that involved Unit 42 analysts and researchers. 

The report analyzed how threat groups are using AI to operate with unprecedented speed and scale, running simultaneous attacks and taking advantage of known software flaws to go after vulnerable targets before those victims can take preventative measures. 

For example, attackers are now targeting vulnerabilities within 15 minutes of a CVE disclosure.

Hackers are also using AI to run reconnaissance and initial access attempts against hundreds of targets at the same time. 

The report shows attackers are abusing trusted integrations to launch attacks against software-as-a-service applications. Nearly one-quarter of incidents involved these types of attacks over the past year. 

These integrations provide legitimate, privileged access, making exploitation of these trusted connections more difficult to defend.

“This is a structural shift in supply chain risk that moves beyond vulnerable code to the abuse of trusted links,” Rubin said.

Seven out of every 10 organizations suffered at least one identity-related breach over the past year, according to a report released by Sophos. Organizations, on average, reported three separate identity-related incidents during that time.

Two-thirds of ransomware victims said the cyberattack stemmed from an identity-related incident, said Sophos. The report is based on a survey of 5,000 IT and cybersecurity leaders across 17 countries. 

The mean recovery cost was $1.64 million, read the report, and the median cost was $750,000. Seven of every 10 respondents reported recovery costs of more than $250,000.

The report underscores the increasing role identity plays in modern enterprise security. 

“Identity is now the perimeter of cybersecurity, and that perimeter is expanding faster than most organizations can track,” Chester Wisniewski, director, global field CISO at Sophos, told Cybersecurity Dive via email. “As cloud adoption, remote work, and machine-to-machine connectivity accelerate, every credential, API key, service account, and OAuth token becomes a potential entry point.”

Hackers are increasingly using identity as the main point of attack, Wisniewski said, because it allows them to bypass traditional security defenses, move laterally within systems and get faster access to sensitive data.

Identity-based cyberattacks impact critical sectors as well. Oil and gas and utility companies, followed by government agencies, reported the highest breach rates across various industries. 

Successful identity attacks are largely due to a combination of human error and poor management of non-human identities, according to the report. Only 24% of companies regularly monitor for unusual logins and fewer than one-third of organizations regularly rotate non-human credentials.  

The rate of data breaches at companies that widely use AI tools is significantly higher than the rate at companies that don’t — 43% compared with 11% over the past 12 months, according to research.

AI tools such as agents significantly increase organizations’ “identity footprint,” creating more gaps that hackers can exploit, a report from identity security firm Netwrix said.

At the same time, Netwrix found, the companies using AI the most widely are also the ones taking identity management the most seriously.

The report highlights the security risks of the sprawling web of user accounts and other identities that companies must create to use agents, copilots and other AI tools.

“AI agents are now acting on behalf of humans against sensitive data,” Netwrix researchers wrote. “Non-human identities need the same operational rigor long applied to privileged human access.”

And yet many companies aren’t taking identity management seriously, the report found. Roughly three-quarters lack “a single, unified view of sensitive data and which identities have access to it,” researchers said. More than half of organizations lack an up-to-date database of sensitive data, 71% can’t quickly determine which identities can access which data and 70% don’t have a security strategy linking data protection with identity governance.

Identity management is far from a new challenge for enterprises, but AI has magnified it, and companies are not always keeping pace. Three-quarters of organizations aren’t fully overseeing what AI identities are doing in their systems, even as 41% say they’re letting AI agents access sensitive data and perform vital tasks.

The findings highlight how hackers have used identity security weaknesses as entry points in target networks. Three-quarters of incidents in which hackers access sensitive data involve compromises of identities or misconfigured account permissions. But despite widespread corporate awareness of this threat, most companies aren’t mitigating it.

Seventy-six percent of organizations can’t immediately revoke inactive accounts’ data access, according to the report, and 72% say their accounts have excessive permissions or they’re unsure which permissions their accounts have. Even more worrisome, roughly two-thirds of organizations said they believe at least some of their accounts have unnecessary access to vital data. Only one-quarter of companies said they were fully confident in their ability to detect potentially dangerous account access permissions.

The report — which also includes data about companies’ readiness to govern their AI systems and the frequency of unauthorized-identity-access incidents in different organization size segments — is based on a worldwide survey of 2,317 security professionals at 1,889 organizations in 60 industries.

The cybersecurity industry devotes a lot of attention to how AI helps hackers analyze vulnerabilities more quickly and craft better malware, but a report argues that AI’s improved impersonation of corporate leaders is proving just as consequential.

Impersonation attacks have targeted either executives or lower-level employees at more than half (53%) of organizations this year, the security firm Outtake said in a report published on June 4.

At the same time, the report found, three-quarters of respondents to Outtake’s survey performed only limited impersonation monitoring or only reacted to attacks as they happened.

AI’s ability to generate convincing fake media has opened “a second front” in businesses’ war against impersonation schemes, Outtake said in its report, which was based on a survey of more than 1,100 cybersecurity and risk-management leaders.

Nearly half (47%) of companies “have already encountered confirmed or suspected synthetic-media impersonation of an executive or brand representative,” according to the report. Additionally, companies identify AI-generated attacks as the biggest visibility gap in their impersonation-prevention strategy.

“People are the most exposed and least protected attack surface,” Outtake said. Only 43% of companies conduct identity-spoofing simulations involving their executives to identify the biggest potential impersonation risks.

Agentic AI

Companies’ preparedness for AI threats isn’t much better when it comes to agentic technologies, the report found. Businesses are largely failing to oversee and protect these agents, according to Outtake, which magnifies the risk of agent-hijacking attacks that could damage businesses’ reputations or finances. Only 4% of businesses said they were fully monitoring and controlling their AI agents.

The report offered an example of an AI agent in the accounting department receiving a seemingly innocuous payment-inquiry email that contains hidden code overriding the agent’s programming and forcing it to share information with an untrusted third party.

“The agent now stands on a new trust boundary: one foot in the untrusted outside world, one in the trusted internal system,” Outtake said. “A planted instruction crosses the boundary between them.”

Governance fragmentation is another major weakness across enterprises. At 21% of companies, there is no one team responsible for assessing and managing digital trust risk to the organization. Security operations centers handle the responsibility at 18% of companies; fraud and safety teams handle it at 13%; and threat intelligence teams handle it at 11%. More than 60% of businesses described their digital trust risk management activities as fragmented and siloed.

A suspected wiper attack against medtech giant Stryker has led much of the security community to examine the role of Microsoft Intune. 

Stryker, a Portage, Mich.-based specialist in surgical equipment, suffered a cyberattack in March that affected thousands of mobile devices and other systems. 

The company, in a regulatory filing, confirmed the attack impacted its Microsoft environment and warned in a customer update that its electronic ordering systems remain unavailable. 

An Iran-linked hacker tracked under the name Handala claimed credit for the attack, according to Check Point Research. The hacker claims to have stolen 50 terabytes of data and to have wiped information from thousands of servers and mobile devices in the process. 

Researchers from Halcyon told Cybersecurity Dive the Stryker attack impacted all phones and workstations with an Intune base-64 string. Intune is normally used to push software or manage devices that are base-64 encoded, according to researchers.

The payload included remote wipe commands, which were used to delete data on all affected devices, according to Halycon.

In order to conduct such an attack, a hacker would need to obtain Intune administrator or global administrator privileges, researchers said. 

MFA as a defense

Paddy Harrington, a senior analyst at Forrester, said the attack does not point to any inherent weakness in Microsoft Intune, but essentially utilizes living-off-the-land techniques to bypass existing security systems. 

Attacks using mobile device management platforms are not new and have been used to conduct significant attacks in recent years. Harrington points to a January attack against the European Commission and a 2020 attack against a multinational firm using a Cerberus banking Trojan. 

“Using MFA to access MDM/UEM can reduce the likelihood of a simple account takeover attack. And for destructive functions like wipe actions, Intune and other modern platforms have a multiaccount approval feature that ensures that no one person can make critical changes,” Harrington told Cybersecurity Dive.

Researchers from Palo Alto Networks Unit 42 would not comment on the specifics of the Stryker attack, but cited a March 6 report from Israel’s National Cyber Directorate about destructive wiper attacks targeting servers and workstations at several companies with the goal of deleting data, according to a blog post. 

In some of those attacks, hackers gained access to credentials or other information from legitimate users and weaponized that to gain initial access to systems, according to Unit 42’s blog post. 

Microsoft has thus far declined to comment on the incident, but a spokesperson told Cybersecurity Dive it would provide an update if any additional information became available.

Stryker has been working with third-party forensic experts to investigate the attack and the Cybersecurity and Infrastructure Security Agency has been investigating the attack as well.