The Perimeter Is Gone. Attackers Already Knew That.
Modern intrusions rarely crack the wall. They walk through the front door, wearing your credentials.
Key points
- Attackers are logging in with stolen credentials and replayed session tokens rather than exploiting technical vulnerabilities
- Push-based MFA is vulnerable to fatigue attacks; OAuth phishing bypasses passwords entirely
- Permission debt lets a single compromised credential reach sensitive systems across an enterprise
- Identity telemetry is still treated as secondary evidence despite being the clearest early warning
- Phishing-resistant FIDO2 authentication and conditional access policies are gaining adoption but need governance to back them up
The alert didn't look like much. A service account, authenticating at an odd hour, pulling permissions it had held for two years but never once used. The analyst on shift almost let it scroll past. Almost.
This is where breaches live now: not in zero-days, not in dramatic firewall bypasses, but in the quiet abuse of identity systems built to say yes. Across incident reports through late 2024 and into 2025, a consistent pattern has emerged. Attackers are logging in, not breaking in. Stolen credentials, replayed session tokens, OAuth consent phishing, adversary-in-the-middle frameworks like the Starkiller phishing kit (which proxies live authentication pages rather than static clones, defeating many detection rules): these are the instruments of the modern intrusion. We first reported on Starkiller back in May 2026, when prompt-bombing attacks were already bypassing MFA at scale.
Why has the perimeter stopped mattering?
When enterprise workloads migrated to cloud platforms and SaaS applications, network location stopped mattering. Identity became the control plane. If an attacker can impersonate a trusted identity inside a federated single sign-on system, many traditional safeguards offer no friction at all.
The identity is often handed over without a fight. Push-based MFA has proved susceptible to fatigue attacks: repeated approval prompts that wear users down until one slip approves a malicious session. OAuth phishing sidesteps passwords entirely, convincing users to grant application-level permissions that persist long after the session ends. Neither technique requires the attacker to touch a firewall.
Should you worry about permission debt?
Initial access is only part of the story. What happens next depends almost entirely on what the compromised identity can do. Most enterprises carry years of permission debt: broadly assigned privileged roles nobody reviewed, temporary access grants never revoked, service accounts with expansive rights and no real monitoring. Adam Meyers, head of Counter Adversary Operations at CrowdStrike, has used exactly that framing. One credential, landing in that environment, can reach financial systems and administrative controls alike.
The principle of least privilege is widely cited and unevenly applied. Establishing just-in-time access models and approval-based privilege elevation demands sustained coordination between security teams, IT operations and business stakeholders, a process often described, charitably, as politically complex. Without it, one compromised identity carries damage far beyond what the attacker earned.
Where should defenders focus next?
The relevant signals are already present in identity logs: anomalous login locations, impossible travel patterns, sudden privilege escalations, suspicious OAuth grants. Those logs are consistently treated as supplementary context rather than primary forensic evidence. Identity telemetry gets less attention than endpoint detection data, and that gap is getting harder to defend.
Some organisations are rerouting investment toward hardware-backed credentials, phishing-resistant FIDO2 authentication and contextual conditional access policies. But the shift needs governance behind it, not just tooling.
Back at that Tuesday alert: the analyst flagged it. A threat hunter pulled the account's full access history. The service account had been quietly enumerating SharePoint directories for six days, appearing at every checkpoint like a legitimate user doing legitimate work.
How long was it in there before anyone looked? Most enterprises still can't answer that.
