Why Identity Has Become the Primary Attack Surface

Report Type
Training

Most attacks don’t break in anymore.

They log in.

‍

In many modern environments, initial access no longer requires:

·        Exploiting a vulnerability

·        Dropping malware

·        Triggering a high-confidence alert

‍ ‍

Instead, it looks like:

·        A user authenticating successfully

·        A session being established

·        Access to systems occurring through normal channels

‍ ‍

From a logging perspective:

Nothing is clearly wrong.

The Core Problem

Traditional detection was built around one assumption:

👉 Malicious activity introduces something new

‍

Something like:

·        A new binary

·        A known bad domain

·        A recognizable signature

Identity-based intrusion does not introduce something new.

👉 It misuses what already exists

‍

That means:

·        Authentication logs appear valid

·        Access tokens are legitimate

·        Application activity follows expected patterns

Detection doesn’t fail because activity is hidden.

It fails because:

👉 Validation succeeds

What Changed

The shift didn’t happen because attackers became more sophisticated.

It happened because they no longer need to introduce anything new.

Instead of breaking into systems:

They can operate entirely within:

·        Valid accounts

·        Trusted applications

·        Approved workflows

At the same time:

·        Credentials are easier to obtain

·        Access is easier to maintain ‍

·        Activity blends into normal operations

👉 The result:

Detection based on “something new appearing” becomes far less effective.

What This Looks Like in Practice

This is what that looks like in real environments.

Scenario 1: Phishing → Account Access → Data Exposure

A user receives a phishing email and enters credentials.

Shortly after:

·        A login occurs from a new location

·        MFA is satisfied (push fatigue or token replay)

·        A valid session is created

Then:

·        The account accesses a SaaS platform

·        Files are viewed or downloaded

·        Internal data is exposed

No malware.
No exploit.
No indicator.

Every action appears legitimate.

Scenario 2: Credential Reuse → Internal Exploration

An attacker uses previously leaked credentials.

They log in successfully.

Then:

·        Access internal applications

·        Query systems they’ve never accessed before

·        Enumerate available resources

Nothing triggers.

Because:

·        Credentials are valid

·        Access is allowed

·        Activity appears normal in isolation

But the behavior is inconsistent with the user’s history. ‍

Scenario 3: Legitimate Tools → Suspicious Sequence

An attacker gains access to an account.

They use only approved tools:

·        Admin consoles

·        SaaS dashboards

·        Built-in system utilities

Then:

·        Access privileged systems

·        Modify configurations

·        Initiate external connections

Every action is allowed.

The problem isn’t the action.

👉 It’s the sequence.

Scenario 4: MFA Bypass → Silent Persistence

An attacker gains session access via token theft or MFA fatigue.

They:

·        Maintain access without re-authenticating

·        Revisit systems periodically

·        Avoid triggering login anomalies

There are no repeated suspicious logins.

Just:

·        Ongoing, low-noise activity

·        Spread over time

·        Within expected boundaries

Where Detection Breaks Down

Across all scenarios:

·        Events are evaluated independently

·        Systems are siloed

·        There is no enforced correlation across time

So the logic becomes:

·        Login → valid

·        Access → valid

·        Action → valid

Case closed.

‍
The problem is not visibility.

‍

👉 It is correlation and interpretation

Where the Signal Actually Lives

The signal is not in the event.

It is in the pattern.
Across these scenarios, patterns look like:

·        First-time login + unusual access

·        Valid session + abnormal sequence

·        Normal tools + unexpected usage patterns

·        Legitimate access + inconsistent behavior

‍ ‍
Individually:

These are weak signals.

Combined:

They form behavior that does not make sense.

What This Means for Detection

Detection must shift from:

·        Event validation

To: ‍

·        Behavior evaluation over time

From:

“Is this login valid?”

To:

“Does this sequence of activity make sense for this user?”

‍

This requires:

·        Correlating identity, endpoint, and network activity

·        Evaluating sequences rather than isolated events

·        Understanding what is normal for a user

Operational Reality

This is difficult.

Because:

·        Signals are noisy

·        Context is incomplete ‍

·        Analysts are time-constrained

‍

Which leads to:

👉 If nothing is clearly malicious, nothing is escalated

‍ ‍
That is the failure point.

Key Takeaway

Attackers can change:

·        Tools

·        Infrastructure

·        Payloads

They cannot avoid:

·        Logging in

·        Accessing systems

·        Moving through environments

That activity creates patterns.
Detection must focus on those patterns.

Final Principle

Most identity-based attacks are fully visible in logs.