The Perimeter Is Gone. Attackers Already Knew That.

The alert did not look like much. A service account, authenticating at an odd hour, pulling permissions it had held for two years but never once used. The analyst on shift — call it a Tuesday in Q1 — almost let it scroll past. Almost.

This is where breaches live now: not in zero-days, not in dramatic firewall bypasses, but in the quiet abuse of identity systems that were built to say yes. Across incident reports compiled by Mandiant, CrowdStrike, and Microsoft's Threat Intelligence team through late 2024 and into 2025, a consistent pattern has emerged — attackers are logging in, not breaking in. Stolen credentials, replayed session tokens, OAuth consent phishing, adversary-in-the-middle frameworks like the Starkiller phishing kit (which proxies live authentication pages rather than static clones, defeating many detection rules) — these are the instruments of the modern intrusion.

The reason is structural. When enterprise workloads migrated to cloud platforms and SaaS applications, network location stopped mattering. Identity became the control plane. If an attacker can impersonate a trusted identity inside a federated single sign-on system, many traditional safeguards offer no friction at all.

And the identity itself is often handed over without a fight. Push-based multi-factor authentication, widely deployed as a first-line defense, has proved susceptible to MFA fatigue attacks — repeated approval prompts that wear users down until one slip approves a malicious session. OAuth phishing sidesteps passwords entirely, convincing users to grant application-level permissions that persist long after the session ends. Neither technique requires the attacker to touch a firewall.

But initial access is only part of the story. What happens next depends almost entirely on what the compromised identity is allowed to do. Most enterprises, said Adam Meyers, head of Counter Adversary Operations at CrowdStrike, carry years of what he calls permission debt: broadly assigned privileged roles that nobody reviewed, temporary access grants that were never revoked, service accounts with expansive rights and no real monitoring. A single credential, landing in that environment, can reach financial systems, customer data, and administrative controls.

The principle of least privilege is widely cited. It is unevenly applied. Establishing just-in-time access models and approval-based privilege elevation demands sustained coordination between security teams, IT operations, and business stakeholders (a process that is often described, charitably, as politically complex). Without it, one compromised identity can carry damage far beyond what the attacker earned.

So the question for security operations centers has shifted. The relevant signals — anomalous login locations, impossible travel patterns, sudden privilege escalations, suspicious OAuth grants — are already present in identity logs. The problem is that those logs are frequently treated as supplementary context rather than primary forensic evidence. Identity telemetry gets less attention than endpoint detection data, even as CVE-2024-49035 and similar authentication-layer vulnerabilities demonstrate that the authentication plane itself is actively targeted.

Some organizations are rerouting investment. Hardware-backed credentials, phishing-resistant FIDO2 authentication, and conditional access policies that weigh contextual risk signals at login time are gaining ground. But the shift requires more than tooling.

Back at that Tuesday alert: the analyst flagged it. A threat hunter pulled the account's full access history. The service account, it turned out, had been quietly enumerating SharePoint directories for six days — appearing, at every checkpoint, like a legitimate user doing legitimate work.

That question — how long was it in there before anyone looked? — is the one most enterprises still cannot answer.