For years the security conversation centered on the network edge: firewalls, segmentation, endpoint agents. The 2026 data tells a different story. Across the largest breach and threat datasets published this year, the most reliable way into an organization is still a valid identity.
Stolen credentials remain the workhorse
Verizon's 2026 Data Breach Investigations Report finds that the use of stolen credentials holds steady at 36% of breaches.1 Vulnerability exploitation overtook credential abuse as the most common initial access vector this year, yet when Verizon counts credential abuse at any point in the breach, it still sits on top at 39%.1 The human element was present in 62% of breaches.2
of detections in CrowdStrike's 2026 data were malware-free, as adversaries used valid credentials, trusted identity flows and approved SaaS integrations.3
Attackers are logging in, then moving fast
CrowdStrike reports that valid account abuse accounted for 35% of cloud incidents.3 Microsoft's 2026 Digital Defense Report adds that 52.2% of valid account intrusions involved follow-on credential theft, and states plainly that identity is the primary control plane for defense.4 A year earlier, Microsoft found that more than 97% of identity attacks were password attacks, and that phishing-resistant MFA can stop over 99% of them.6
The bill keeps climbing
IBM's 2026 Cost of a Data Breach study puts the global average at USD 4.99 million, a 12% increase and a record high.5 Its first recommended action for leaders is to secure and control agentic identities, a sign of where the next wave of exposure is forming.5
What we tell clients
- Treat identity as infrastructure. Directory, access management and governance deserve the same uptime, change control and architecture review as your network.
- Retire phishable factors. SMS codes and passwords alone are the methods attackers expect. Move high-value users and customers to phishing-resistant options first.
- Watch the session, not only the login. Follow-on credential theft means continuous evaluation of risk after sign-in matters as much as the sign-in itself.
- Govern machine and agent identities now. They are multiplying faster than any human population and inherit whatever access you grant them.
None of this requires a new category of tool. It requires treating the identity layer as the place where security decisions are actually made.
Related insights
Every bill you pay on your phone is an identity decision
If you have ever logged in to a telecom app to pay a bill or check your account, you have used the kind of system we build. Here is why that sign-in screen has become one of the most attacked doors in consumer technology.
Passkeys passed the tipping point. Now comes the hard part.
Billions of passkeys exist and most consumers know what they are. The remaining work sits inside enterprises still relying on phishable sign-in.
NIST SP 800-63-4 in five changes
The updated US digital identity guidelines rewrite long-held password rules and raise the bar on phishing resistance. A short guide for architects.