Security budgets keep climbing, and breach reports keep pointing to the same weak spot. Most attackers do not break in. They log in. Identity, the web of credentials, permissions, and accounts that connect people and software to company systems, has become the busiest route into a business network, and it is often the one area IT budgets overlook.
Why is identity now the biggest attack surface?
Modern businesses run on a mix of directory services, cloud platforms, and both human and machine accounts. Each identity carries its own set of permissions, and those permissions create pathways that cut across the system boundaries IT teams normally defend. When a cybercriminal compromises one credential, they do not just steal a password. They inherit every privilege attached to that identity.
This is why most modern attacks skip custom malware entirely. Attackers exploit chains of access instead. A saved password on a retail laptop might lead to a forgotten, overprivileged group inside a company directory. That group could unlock a cloud environment, which holds the keys to administrative policy. Cybercriminals link these separate, unmonitored permissions together and move from a low-level foothold to an organization’s most sensitive assets, a technique known as lateral movement.
Identity weaknesses played a role in nearly 90% of the breaches Palo Alto Networks investigated for its 2026 Unit 42 Global Incident Response Report. Cybercriminals are taking the path of least resistance. They simply log in. Consolidating logins through single sign-on reduces the number of standing passwords an attacker can target, but a single stolen session token can still hand over every privilege tied to that identity.
Why do AI agents and machine accounts raise the risk?
Artificial intelligence is speeding up this problem. Nonhuman identities, meaning service accounts, API keys, and increasingly autonomous AI agents, are multiplying inside company networks faster than most IT teams can track them. These accounts often carry more privileges than any single employee, which makes them a high-value target for attackers.
Credential theft targeting these nonhuman accounts is rising quickly. SpyCloud’s 2026 Annual Identity Exposure Report identified 6.2 million credentials or authentication cookies tied to AI tools already circulating among cybercriminals.
A common scenario looks like this:
- Configuration: A development team connects an AI tool to internal systems through a software bridge, so the assistant can pull data or trigger actions automatically.
- Inherited access: The AI agent takes on whatever high-level permissions were granted to that bridge, often more than any single employee would have.
- Exploitation: A flaw in the open-source software behind that bridge gives a cybercriminal a way to hijack the AI agent’s identity, with immediate access to production databases and cloud resources.
These high-value, nonhuman credentials are now traded by the millions on underground marketplaces. We recently looked at letting AI agents operate inside company systems through Windows 11’s new Agent Workspace, and identity is exactly where that risk tends to surface first.
Why do traditional identity tools miss these attacks?
Despite rising security budgets, identity-based attacks keep climbing. IBM’s 2026 X-Force Threat Intelligence Index found that compromising valid accounts caused 32% of initial security breaches, the second most common entry point behind phishing.
The problem often traces back to how older identity tools were designed. They were built for a more compartmentalized era of security.
- User management platforms: These handle onboarding, offboarding, and access requests well, but they are blind to real-time threats, such as a compromised account moving between systems it was never meant to touch.
- Password vaults: These protect high-level credentials effectively, but they cannot detect when several lower-tier accounts are chained together to route around the vault entirely.
These systems mostly operate in silos, so none of them can map the relationships between endpoints, directories, and cloud workloads on their own. A role provisioned for a temporary cloud migration might look compliant to a user management tool, while in the wider network it works like a hidden backdoor. This same gap is what makes protecting sensitive company data so difficult without a unified view of who can reach it.
Strong authentication design still matters here. NIST’s Digital Identity Guidelines lay out how identities should be proofed, authenticated, and governed over their full lifecycle, a standard many commercial tools are still catching up to. Understanding the difference between two-step and two-factor authentication is a useful starting point for choosing verification methods that actually slow an attacker down.
How can businesses close the identity gaps?
The good news is that most of these breaches are preventable. Palo Alto’s researchers found that in more than 90% of the incidents they investigated, preventable gaps, not novel attacker sophistication, made the difference: limited visibility, inconsistent controls, and excessive identity trust. These conditions delayed detection and created easy paths for lateral movement once attackers gained access.
This is the practical case for zero trust principles: assume that any account, human or machine, could already be compromised, and verify every request rather than trusting anyone by default. We’ve written before about how to prioritize a zero trust rollout without disrupting the systems your team relies on every day.
Basic habits still carry weight too. Unique, per-account passwords managed through a password manager, paired with multifactor authentication everywhere it is offered, remove a lot of the easy wins attackers rely on. We cover more of these fundamentals in our guide to securing accounts for a distributed workforce.
Security teams need to move past a simple gatekeeper mindset. That means continuously mapping identities, access policies, and the connections between them in the real world, not just at the moment someone requests access. Until that mapping happens, identity will remain the most efficient way into a business network.
Common questions about identity-based cyberattacks
What does it mean that identity is the new perimeter?
It means access, not network location, is the main thing attackers need to reach sensitive systems. As more work moves to the cloud and to SaaS tools, the old idea of a secure network boundary matters less than who, and what, can log in.
What is lateral movement in a cyberattack?
Lateral movement is when an attacker uses one compromised account or device to reach others across a network, expanding their access step by step until they reach a high-value target.
Are AI agents really a security risk for small businesses?
Yes. Any AI tool connected to internal systems inherits the permissions of that connection. If those permissions are too broad, or the connection has a flaw, an attacker can use the AI agent’s own access against the business.
Can multifactor authentication alone stop identity-based attacks?
MFA helps significantly, but it is not a complete solution on its own. Attackers who steal a session token or exploit an overprivileged account can sometimes bypass MFA entirely, which is why visibility into how permissions connect across systems still matters.
How can a Pittsburgh-area business start addressing this?
Start with an inventory of who, and what, has access to critical systems: human employees, service accounts, and AI tools alike. CyberJaz helps small and mid-sized businesses in the Pittsburgh area map these access paths and close the gaps attackers rely on most.
Don’t let hidden identity weak spots give cybercriminals an easy way into your systems. Get in touch with our IT experts today to stay ahead of new attacks and keep your business safe.
