Identity is the perimeter, so what guards identity?
In plain words: The wall around the office matters less now and the badge matters more, so look after the badges: hard to copy, each with an owner, and watched once used. Identity and access, explained simply
In short
- Zero trust moved the perimeter from the network to identity. Attackers noticed: signing in with someone else's credentials is now one of the two commonest ways into an organisation.
- The accounts that hurt most are rarely the well-run ones. They are test accounts, service accounts and old integrations that nobody owns and nobody reviews.
- Guarding identity takes three things: sign-in that cannot be phished, a named owner for every account, and monitoring of what a session does after it starts.
The shift
When access is decided by who is asking rather than where they sit, the identity system becomes the most valuable thing an attacker can reach. Verizon's 2025 Data Breach Investigations Report puts credential abuse at 22% of initial access, just ahead of exploited vulnerabilities at 20%. Passwords leak from infostealer malware, from reuse across sites and from phishing pages that now relay one-time codes in real time.
So "we have multi-factor authentication" is no longer the end of the conversation. A code sent by text message or a push prompt can be phished or tapped through by a tired person. CISA's guidance is plain: phishing-resistant methods, meaning FIDO2 security keys, passkeys or smart cards, are the standard to aim for.
Where it actually breaks
Two public incidents show the pattern better than any framework.
In January 2024 Microsoft said a state-backed group had used password spraying against a legacy, non-production test tenant account that did not have multi-factor authentication. From there the attackers used an old OAuth application with elevated access to reach corporate mailboxes, including those of senior leaders.
In late 2023 Okta found that a service account used by its support system had its username and password saved in an employee's personal Google profile on a work laptop. The likeliest route to the attacker was that personal account. Files from 134 customers were accessed.
Neither case was a failure of the main sign-in for staff. Both were accounts on the edge: a test account, an old app, a service account. That is where I would look first in any organisation.
What guards identity
My own view is that it comes down to three layers.
- Sign-in that cannot be phished. Passkeys or security keys for staff, starting with administrators and anyone who can approve payments or change access. Remove the fallbacks that let an attacker downgrade to a weaker method.
- An owner for every identity. Every account, human or not, has a named person who can say why it exists. Accounts without an owner are disabled after a fixed period. Service accounts use managed credentials or workload identity, not passwords saved in a browser.
- Watching the session, not only the login. Most identity tools judge the moment of sign-in. Stolen session tokens skip that moment entirely. Signals after login, such as a new device, an impossible journey or a sudden change in what is accessed, matter as much as the login itself.
What to do on Monday
- Ask for a list of accounts that can sign in without phishing-resistant authentication, and start with the privileged ones.
- Find the test tenants, legacy apps and service accounts. Give each one an owner or switch it off.
- Check which OAuth applications hold broad permissions in your directory, and who granted them.
- Make sure someone is alerted when a session token is used from somewhere it was never issued.
Sources
- Verizon, 2025 Data Breach Investigations Report (2025).
- CISA, Implementing Phishing-Resistant MFA (2022).
- Microsoft Security Response Center, Microsoft actions following attack by nation state actor Midnight Blizzard (January 2024).
- Okta, Unauthorized access to Okta's support case management system: root cause and remediation (November 2023).
- NIST, SP 800-207: Zero Trust Architecture (2020).
- Earlier on this topic: Is an AI agent just another non-human identity?
- Later on this topic: Governing AI agents: keep the record, expire the access
Personal work and my own view, not my employer's. Sources are public.