The Identity Gap: Why Trust Has Become the New Attack Surface
In The 72-Minute Race, we explored how attackers are compressing the time between initial access and business impact. But as attacks continue to accelerate, another trend has emerged: Attackers are increasingly gaining access through compromised identities rather than exploiting technology vulnerabilities.
According to the 2026 Unit 42 Global Incident Response Report, identity weaknesses played a role in nearly 90% of incidents investigated by Unit 42. The report also found that 65% of initial access activity involved identity-based techniques, underscoring how credential theft, multifactor authentication (MFA) manipulation, session hijacking and social engineering have become some of the most effective ways to gain access to enterprise environments.
Anatomy of a Modern Identity-Driven Compromise
Across recent Unit 42 investigations, we see a consistent pattern. Attackers often gain initial access through:
- Phishing campaigns
- Social engineering calls
- MFA fatigue attacks
- Compromised third-party accounts
- Misuse of help desk processes
Once inside, attackers establish persistence, elevate privileges and move laterally across various environments. These activities often resemble legitimate administrative behavior. Malicious activity can remain hidden long enough for attackers to broaden their foothold before security teams recognize the full scope of the incident.