Identity Is the New Attack Path

Identity is no longer just where attackers get in. It is how they get from a foothold to something that matters.

“Identity is the new perimeter” has been repeated for a decade, and it is only half right. Current evidence does not show stolen passwords as the dominant way in. Verizon’s 2026 Data Breach Investigations Report puts vulnerability exploitation first, at 31% of breaches, ahead of stolen credentials. Mandiant’s M-Trends 2026 has exploits at 32% of intrusions, voice phishing second at 11%, and email phishing down to 6%.

What the case evidence does show is that, once an attacker is inside, identities decide how far they go.

The front door varies. What happens next does not.

Mandiant’s 2025 investigations show a mixed set of entry points: exploited vulnerabilities, voice phishing aimed at employees and help desks, and prior compromise. Prior compromise was the third most common vector overall at 10%. In ransomware cases it was the leading vector at 30%, double its 2024 share of 15%.

After entry, the same ingredients keep appearing. Mandiant describes attackers harvesting long-lived OAuth tokens and session cookies. It describes compromised third-party SaaS vendors yielding hard-coded keys and personal access tokens that open the vendors’ customers. It reports ransomware operators abusing misconfigured Active Directory Certificate Services templates to create administrator accounts that sit outside password rotation.

The time to react is short. CrowdStrike reports an average eCrime breakout time of 29 minutes in 2025, with the fastest observed at 27 seconds. Mandiant reports that the median gap between initial access and hand-off to a secondary threat group fell from more than eight hours in 2022 to 22 seconds in 2025.

Anatomy of an identity attack path

A path is a chain of hops, and each hop uses something legitimate. Public reporting documents real cases for most of them.

The Drift case shows the whole shape in one incident. According to Google’s analysis, the activity ran from at least 8 August to 18 August 2025, and Salesloft and Salesforce revoked all active Drift tokens on 20 August. The key was a token tied to a trusted vendor application. OAuth tokens authorize API calls without a fresh sign-in, so there was no MFA prompt to defeat. From the data it exported, the actor looked for secrets that could open other systems. Google assessed the primary intent as credential harvesting.

Why these paths are hard to see

In our assessment, three things hide them.

Inventories are built around people. Attack paths run through machines: service accounts, API keys, OAuth applications, workload identities, vendor integrations. A list of employees and administrators does not show them, and few of these identities have a named owner.

Each tool sees a slice. The identity provider sees sign-ins. The SaaS admin console sees app grants. Cloud IAM sees roles. The directory sees groups. The help desk system sees resets. Nobody holds the chain, and an attacker only needs the links.

Recovery paths are privileged paths. A password reset, an MFA enrollment and a federation change are all ways to become someone else. They are often handled as routine IT service tasks. UNC6040 and Scattered Spider both used the human side of these processes.

What to change

1. Map paths backwards from the business asset. Pick a handful of systems whose loss would hurt most. List every identity that can reach them, human and non-human, then how each could be obtained. Fix the shortest paths first.

2. Inventory non-human identities and token lifetimes. Long-lived OAuth tokens, API keys and hard-coded secrets are what Mandiant reports attackers harvesting. Set owners, scopes and expiry. Remove what nobody can justify.

3. Treat help desk resets, MFA enrollment and federation changes as privileged operations. Add identity verification, approval for privileged accounts, and an alert on every instance.

4. Fix the choke points. Directory services, certificate services and cloud administrator roles connect many paths. Review AD CS templates and standing privilege first.

5. Test the path, not just the entry. Start an exercise from a given identity foothold and time how long each hop takes to detect. Entry controls are tested often. Hops two to four are tested rarely.

What this evidence does not show

Public incident reports over-represent organizations that were investigated or chose to disclose. Mandiant’s figures describe cases where Mandiant was engaged. Verizon’s describe its contributors’ data. Percentages should not be compared across reports or years without care.

No public source gives a clean measured rate for how many intrusions use an identity path after entry. The argument in this article rests on documented cases and analysis. It is an interpretation of that evidence, and a consistent one, but not a single statistic.

Where to start

Choose one system the business cannot lose. List every identity that can reach it. For each, write down how an attacker could obtain that identity and who is able to reset it. Where the honest answer is “a help desk agent on a phone call” or “a token nobody has reviewed since it was issued”, you have found a path.

Sources

1. Google Cloud / Mandiant. M-Trends 2026: Data, Insights, and Strategies From the Frontlines (23 March 2026)

2. Verizon. 2026 Data Breach Investigations Report

3. Help Net Security. Verizon DBIR: Vulnerability exploitation is the dominant initial access vector

4. CrowdStrike. 2026 Global Threat Report (press release)

5. Google Threat Intelligence Group. The Cost of a Call: From Voice Phishing to Data Extortion (4 June 2025, updated August 2025)

6. Google Threat Intelligence Group. Data Theft From Salesforce Instances via Salesloft Drift (UNC6395)

7. FBI and CISA. Scattered Spider, Advisory AA23-320A (November 2023)