TL;DR: Identity remained the most targeted attack surface in Expel’s 2026 Annual Threat Report, which says 68.6% of incidents it saw in 2025 involved identity as the primary entry point; the report also argues security teams need to translate control success into business risk and dollars, not just block counts, according to Expel. That framing matters because stronger identity controls change the meaning of an incident, not the need for governance.
At a glance
What this is: Expel's 2026 Annual Threat Report says identity was the primary attack surface in most incidents it saw, and that success has to be measured in risk reduction, not just blocked attempts.
Why it matters: For IAM, PAM, NHI, and broader security teams, the report underscores that stronger controls change the impact of identity attacks, so governance has to track business exposure as well as technical events.
By the numbers:
- 68.6% of all the incidents Expel saw in 2025 involved identity as the main attack surface.
Context
Identity attacks remain a governance problem because they can succeed even when perimeter controls are working. Modern identity stacks such as SSO, MFA, passkeys, logging, and behavioural analysis reduce attacker opportunity, but they do not remove the need to measure whether those controls are lowering business impact.
This report is about the gap between operational security metrics and business risk metrics. The identity angle is direct: when access is blocked or reset at the identity layer, teams need a way to translate that control success into reduced exposure, lower loss potential, and clearer decision-making for leaders.
Key questions
Q: What breaks when identity controls stop an attack but the business still sees it as a near miss?
A: The measurement model breaks. If teams count only blocked attempts, they can miss the difference between a prevented compromise and a confirmed incident. Security leaders should classify identity events by exposure, business impact, and containment outcome so reporting shows whether controls reduced risk or simply generated more alerts.
Q: Why do identity attacks matter so much even when MFA and passkeys are in place?
A: Because strong authentication changes attacker methods, not attacker interest. When passwords alone no longer work, adversaries pivot to session theft, phishing, token abuse, or social engineering. The real question is whether the rest of the identity stack can detect and contain those follow-on paths before they create business loss.
Q: How can security teams know whether identity controls are actually reducing breach impact?
A: Look for evidence that suspicious accounts are contained fast, active sessions are terminated, and privileged access is limited to the smallest possible set of systems. If a compromised account can still reach sensitive resources after detection, the controls are not working well enough to limit impact.
A: When the blocked attempt would have reached sensitive data, privileged workflows, or revenue-critical applications if it had succeeded. In those cases, the incident should feed risk and finance reporting, because the value of the control is the harm it prevented, not the alert it generated.
Technical breakdown
Why identity is still the dominant attack surface
Identity remains the most efficient way in because authenticated access often carries more privilege and trust than a perimeter event. Attackers prefer credential theft, session abuse, and account takeover because a valid identity can bypass many downstream controls. Even with better authentication and detection, the attack path shifts rather than disappears, which is why identity telemetry stays central to incident response and prevention.
Practical implication: measure identity controls by how much they shrink attacker opportunity and blast radius, not by login volume alone.
How MFA, SSO, and passkeys change the attack economics
MFA, SSO, and passkeys make stolen passwords less useful, but they do not eliminate identity risk. They force attackers toward token theft, social engineering, session hijacking, or MFA fatigue tactics, and those paths can still lead to account compromise if lifecycle and detection controls are weak. The real architectural change is that authentication becomes only one layer of trust, not the entire control boundary.
Practical implication: pair strong authentication with session monitoring, device trust, and rapid credential revocation.
Why security teams need business-risk metrics
Counting blocked attacks tells you about control activity, not organisational exposure. A blocked identity attack may be a technical incident, yet from a business standpoint it can be a near miss with little or no loss. That is why risk quantification matters: it connects identity events to dollars at risk, expected loss, and the value of faster containment or stronger controls.
Practical implication: build reporting that ties identity incidents to estimated loss avoided, response time, and control effectiveness.
Threat narrative
Attacker objective: The attacker wants valid access that looks legitimate enough to bypass perimeter controls and reach business systems.
- Entry begins with identity compromise attempts such as stolen passwords, session abuse, or phishing against trusted users and accounts.
- Escalation occurs when the attacker obtains a valid identity that can pass authentication controls or leverage existing trust relationships.
- Impact follows when the attacker uses that access to reach business systems, though improved controls can block or reduce the harm at the identity layer.
Breaches seen in the wild
- Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
- CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Identity is now a business-risk control point, not just an authentication layer. Expel's report reinforces a point many teams still understate: identity controls change loss potential, not merely access success rates. When SSO, MFA, and passkeys stop an attack, the meaningful outcome is reduced business exposure, not a higher block count. Practitioners should report identity performance in terms leaders can use for risk decisions.
Block counts are an incomplete security language for executive governance. The report's central tension is between technical success and organisational value. A blocked login attempt may matter operationally, but boards and finance leaders need to know what that block prevented in dollars, downtime, or fraud exposure. Practitioners should translate identity outcomes into expected loss and residual risk.
Identity telemetry has become the deciding evidence for control effectiveness. Because identity is the main attack surface in the report, teams need visibility into where authentication succeeds, where attackers pivot, and how quickly compromise is contained. That makes identity logs, behavioural signals, and response timelines core governance data. Practitioners should treat identity telemetry as part of the risk model, not just the SOC feed.
Cost-of-control arguments now depend on proving blast-radius reduction. The most defensible security investment is not the one that blocks the most attempts, but the one that measurably lowers impact when identity is probed or abused. That reframes IAM, PAM, NHI, and detection investments around containment economics. Practitioners should evaluate controls by the loss they prevent, not the alerts they generate.
What this signals
Identity risk is now a governance metric. Teams should stop treating blocked logins and resets as isolated SOC outcomes. When identity is the dominant attack surface, the real programme question is whether those controls are lowering expected loss across the business.
Control success needs a financial translation layer. Security leaders who cannot connect authentication outcomes to dollars saved will struggle to defend investment decisions. The practical shift is from event counting to loss reduction modelling.
Identity telemetry should sit beside risk reporting. Authentication logs, session data, and behavioural signals are not just detection inputs. They are evidence for whether IAM, PAM, and adjacent controls are changing the organisation's exposure profile.
For practitioners
- Translate identity incidents into loss metrics Map blocked logins, resets, and takeover attempts to estimated downtime, fraud exposure, and remediation cost so executive reporting reflects business impact, not only security activity.
- Instrument identity-layer control outcomes Track whether SSO, MFA, passkeys, and conditional access are reducing successful compromise and shortening containment time, then report those outcomes alongside incident counts.
- Separate blocked attempts from true compromise Classify password exposure, blocked access, and confirmed account takeover differently so teams do not overstate incident severity or understate control effectiveness.
- Use identity telemetry in risk decisions Feed authentication, session, and behavioural logs into risk reporting so leadership can see where identity remains the main attack surface and where controls are actually working.
- Prioritise response where business exposure is highest Focus containment and recovery effort on identities that reach sensitive systems, privileged workflows, or revenue-impacting applications first, because not all identity incidents carry the same loss potential.
Key takeaways
- Identity attacks remain central because valid access still offers attackers the fastest route through trusted systems.
- Expel's report shows 68.6% of incidents in 2025 involved identity as the main attack surface, which makes identity governance a board-level risk issue.
- The right success metric is not how many attacks were blocked, but how much business loss was prevented or reduced.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV.RM-01 — Risk Management Strategy | The article is fundamentally about translating identity controls into business risk measures. |
| PR.AA-05 — Access Permissions, Entitlements and Authorizations | Identity attacks target access and authorisation outcomes directly. | |
| Recommendation — Align identity reporting to risk appetite and expected-loss measures, not only incident counts. Review permissions and authentication outcomes together to confirm identity controls are actually reducing exposure. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Passwords, MFA, and passkeys are central to the report's identity discussion. |
| Recommendation — Apply authenticator management controls to limit credential usefulness after exposure or theft. | ||
| MITRE ATT&CK | TA0006 — Credential Access | The report's identity incidents map to attacker pursuit of usable credentials and sessions. |
| Recommendation — Map identity incidents to credential access techniques so detections and response priorities match attacker behaviour. | ||
| CIS Controls v8 | CIS-5 — Account Management | Account lifecycle and account state are central to reducing identity attack impact. |
| Recommendation — Strengthen account management to reduce stale access and shrink the opportunity for takeover. | ||
Key terms
- Identity Attack Surface: Identity attack surface is the total set of accounts, tokens, login endpoints, trust paths, and supporting systems that can be probed for access. For password spraying, the risk grows with every externally reachable authentication path and every dormant or weakly protected identity.
- Risk Translation Layer: A risk translation layer is the process or system that converts technical cyber signals into business-relevant impact statements. In GRC programmes, it links posture data to loss, interruption or regulatory categories so that leadership can make decisions in the same language as the risk register.
- Blast-Radius Reduction: A containment approach that limits how far an attacker can travel after gaining initial access. It combines segmentation, least privilege, and isolation controls so a single compromised system cannot easily become an enterprise-wide breach.
Deepen your knowledge
The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, secrets management, and related identity control concepts. It helps practitioners connect identity risk to the operational decisions their programmes need to make.
Published by the NHIMG editorial team on August 19, 2026.
Updated on October 12, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org