Identity security in 2026: attackers sign in

On 31 December 2025, analyst Todd Thiemann at Omdia set out four expectations for the identity field in 2026. AI agents are moving into core applications and business processes, and the year is expected to bring high-profile breaches and fraud originating from poorly governed agents. Identity governance is expected to reach mid-sized organisations, identity teams are expected to work more closely with the security operations centre, and identity tools are expected to consolidate into platforms. Behind the predictions sits an adage Thiemann himself quotes: adversaries do not hack their way in, they log in.

What happens technically

The adage describes a measurable reality. More than 97 percent of the identity attacks Microsoft observes are password attacks, and in 2024 the company reported blocking around 7,000 such attacks per second. Identity-based attacks grew 32 percent in the first half of 2025 alone. The defence holds a strong card at the same time: according to Microsoft's Digital Defense Report 2025, multifactor authentication can block over 99 percent of identity-based attacks. That is exactly why attackers now target the methods that bypass or trick the multifactor step, rather than guessing ever more passwords.

The toolbox has four main moves, and all of them are worth knowing. Real-time phishing, the so-called AiTM attack, uses a fake sign-in page that relays everything the victim types and steals the sign-in token itself; Microsoft measured a 146 percent increase in such attacks in 2024. MFA fatigue, which CISA calls push bombing, means an attacker who already holds the password triggers push notifications by the hundreds until the user approves, by accident or out of sheer irritation. The third move is the help desk: the attacker calls, claims to be an employee, and asks for a new password or a new multifactor enrolment. The fourth is purchased credentials: infostealer malware harvests saved passwords from infected machines, and the credentials are sold on and remain valid for as long as nobody changes them. On top of these come session tokens, small proofs that someone is already signed in, which can be stolen and replayed without any password at all.

The incidents of recent years show each move in practice. At MGM Resorts in September 2023, the attackers posed as employees and talked the help desk into giving them access, and from there they reached the company's Okta environment; operations were disrupted at several properties, and MGM estimated the impact at roughly 100 million dollars. At Change Healthcare in February 2024, the entry point was a remote access portal without multifactor, where stolen credentials were all it took; nine days later the ransomware group locked the systems, and the company paid 22 million dollars in ransom. In the 2024 Snowflake campaign, about 165 organisations were notified after sign-ins with purchased credentials against customer accounts without multifactor; at least 79.7 percent of the abused accounts traced back to older infostealer leaks, and the oldest infection dated to November 2020. And at Okta in October 2023, the attacker used session tokens from uploaded troubleshooting files to hijack valid sessions at five customers; the root cause was an employee signing in to a personal Google profile on a work machine, which put a service account's credentials into private cloud storage.

The numbers from the big reports add nuance to the picture at the same time. In the 2026 edition of Verizon's Data Breach Investigations Report, abuse of stolen credentials is down to 13 percent of breaches, while vulnerability exploitation has climbed to 31 percent; it is the first time in 19 years that stolen credentials are not the biggest way in. IBM measured in 2025 that phishing overtook stolen credentials as the most common initial attack vector. Identity has not become less important for that reason: the human element was present in 62 percent of breaches, breaches that started with compromised credentials took 246 days on average to identify and contain, and only 23 percent of third-party organisations fully remediated missing or improperly secured multifactor authentication on their cloud accounts.

What this means for your organisation

For your organisation, the lesson from the incidents is uncomfortably concrete. None of the four attacks required advanced technology. They required a password gone astray, a help desk without control questions, or a single portal where multifactor was not switched on. UnitedHealth's chief executive told the Senate that multifactor was standard across the group, yet missing on the very server the attackers found. That is what identity attacks look like in practice: not a breakthrough on the attacker's side, but one forgotten exception on the defender's side. The Norwegian National Security Authority (NSM) accordingly sets multifactor authentication as a minimum requirement for accounts with access to critical data and systems, and warns in particular about unused accounts left behind by suppliers and former employees, which have been abused time and again.

Thiemann's predictions point to the next wave of the same problem. When AI agents get their own access to business systems, a category of accounts appears that often lacks an owner, a lifecycle and logging. IBM found that 97 percent of organisations that experienced an AI-related security incident lacked proper access controls on their AI systems. Identity teams already have plenty to manage: 11 different identity tools on average, and 11 person-hours to investigate a single critical identity alert, according to Omdia. The governance task therefore comes before the technical one. Who owns which identities, how long should they live, and who notices when one of them is abused? The NIS2 directive places that responsibility with leadership.

Berigo recommends

• Introduce phishing-resistant multifactor (passkeys/FIDO2) for administrators and critical roles first. CISA calls the method the gold standard. Where it is not yet in place, enable number matching in push notifications.
• Require multifactor on everything exposed to the internet, especially remote access, cloud accounts and supplier access, and hunt systematically for the exceptions. The Change Healthcare attack went through one of them.
• Give the help desk a fixed verification routine for password and multifactor resets. The MGM attack started with a phone call.
• Clean up the accounts: remove unused accounts left by suppliers and former employees, check new passwords against leak lists, and rotate credentials that may sit in older leaks. The Snowflake campaign used passwords stolen years earlier.
• Give every AI agent and service account a named owner, a defined lifetime, least-privilege access and logging before it goes into production.