Identity attacks, session abuse, and vendor risk will dominate 2026

At a glance

What this is: This is a 2026 security outlook that says identity, session abuse, SaaS behaviour, and runtime vendor risk will outrank malware and static trust checks.

Why it matters: It matters because IAM, NHI, and SOC programmes need to detect what identities do after login, not just whether a gate was passed.

By the numbers:

• Identity-based attacks will officially exceed 60% of all successful breaches by 2026, according to Exaforce.

Context

The core security problem is no longer initial authentication. Mature programmes still assume that verifying who or what logged in is enough to trust the resulting activity, but the article argues that this assumption fails once attackers use valid sessions, OAuth grants, and SaaS-to-SaaS pathways instead of malware.

For identity governance, that shifts the control plane from login events to post-login behaviour. The article frames identity, SaaS, and supply chains as the new front line because misuse often hides inside approved workflows, legitimate integrations, and trusted vendor connections that traditional perimeter checks do not inspect deeply enough.

The article’s central claim is that security teams will need runtime evidence, not static assurance, to understand whether access remains appropriate after authentication. That is as relevant to human users as it is to service accounts, tokens, and third-party access paths.

Key questions

Q: What breaks when attackers can steal MFA session tokens?

A: MFA stops being the control point once the attacker has a valid token or cookie. The real failure is that the session is trusted after authentication, so the attacker can reuse access without reentering credentials. Organisations need to treat token replay as an identity event, not just an endpoint or phishing problem.

Q: Why do OAuth sessions create more risk than traditional login events?

A: OAuth sessions can carry trust forward after the initial authentication step, which means one successful approval can unlock access across multiple services. That makes the session itself a governance object. The risk grows when token reuse, brokered apps, or consented scopes let the original access fan out beyond the original user intent.

Q: How should security teams detect abuse when attackers use legitimate identities?

A: Security teams should correlate successful authentication with downstream behaviour such as unusual file access, privilege escalation, bulk export, and lateral movement. A legitimate login is only a starting signal. The real question is whether the identity acts inside its expected operational boundary. That requires identity telemetry, endpoint context, and application activity to be analysed together.

Q: What should organisations change when third-party risk depends on runtime behaviour?

A: They should move from document-based assurance to live monitoring of third-party identities, tokens, and integrations. The practical question is whether a vendor connection is behaving inside its expected scope today, not whether it passed a questionnaire months ago. Runtime evidence must drive containment and review.

Technical breakdown

Why authentication no longer proves trust

Authentication confirms that a credential or session was accepted, but it does not validate the intent or downstream behaviour of the actor using it. In modern SaaS and cloud estates, attackers can hijack a session cookie, replay a token, or ride a delegated OAuth grant without tripping the same controls that catch malware. That means the security question moves from “did the login succeed?” to “did the post-login activity match the expected identity and context?” For IAM and SOC teams, this is a behavioural control problem, not just an authentication problem.

Practical implication: monitor post-login actions against expected behaviour baselines, not just successful authentication events.

How session abuse changes identity attack paths

Session abuse turns a trusted interaction into an attacker transport layer. Once a token, cookie, or access grant is active, the attacker inherits whatever the session is allowed to do until it expires or is revoked. That creates a gap between authentication and authorization that static MFA cannot close on its own. The article also points to SaaS-to-SaaS lateral movement, where one approved integration can become a bridge into unrelated data or workflows. For identity teams, the architectural issue is that trust becomes session-scoped and highly reusable across systems.

Practical implication: bind session monitoring to privilege scope and revoke abnormal sessions globally when behaviour drifts.

Why runtime vendor risk replaces questionnaire-based assurance

Third-party risk changes when the meaningful threat is a live API token, compromised integration, or vendor identity behaving badly in production. A questionnaire or SOC 2 document can describe policy, but it cannot describe today’s runtime access pattern. That is why runtime behaviour becomes the real assurance signal. If a vendor integration begins touching unexpected datasets, moving laterally, or exporting data at unusual speed, the control failure is not contractual. It is operational, and it must be detected in motion rather than after review cycles close.

Practical implication: instrument third-party identities with the same runtime controls and alerting used for internal privileged access.

Threat narrative

Attacker objective: The attacker aims to blend into trusted identity and SaaS activity long enough to exfiltrate data or expand access without triggering traditional endpoint-focused controls.

1. Entry occurs through credential theft, token replay, session abuse, or an OAuth grant that already has trust attached to it.
2. Escalation happens when the attacker uses legitimate SaaS workflows, privileged actions, or overbroad integration permissions to expand access without malware.
3. Impact follows when data is moved, exported, or manipulated through trusted sessions before detection or revocation catches up.

Breaches seen in the wild

• BeyondTrust breach 2024: A stolen BeyondTrust Remote Support API key let a China state-sponsored actor reset accounts and reach US Treasury workstations in 2024.
• reviewdog Action compromise 2025: A stolen maintainer token poisoned reviewdog/action-setup, leaking CI secrets including the tj-actions bot token used in the next attack.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity trust has moved from a login event to a runtime decision: The article is right that authentication alone no longer defines trust, because attackers increasingly operate through valid sessions, tokens, and SaaS permissions. That shifts the governance problem from identity proof to identity behaviour, which is a materially different control question. Programmes that stop at the gate are measuring entry, not risk.

Session abuse exposes the gap between who authenticated and what was authorised: A valid MFA challenge does not stop a hijacked session from being used for abnormal exports, repo access, or lateral movement. The important control distinction is no longer the password or the prompt, but whether the session’s activity remains congruent with the expected actor and context. Practitioners should treat this as a continuous authorization problem, not a one-time login success.

Runtime vendor risk is the new third-party assurance model: Static attestations cannot represent what a third-party identity is doing right now in a live tenant. That means vendor risk management is becoming an identity telemetry problem, especially where SaaS integrations and API tokens can move laterally across business functions. Security teams need to judge third-party access by observed behaviour, not by paperwork age.

Identity blast radius is the decisive metric for 2026: The article’s strongest signal is that attackers win by moving fast inside trusted identity paths, not by making noise at the edge. Identity blast radius: the amount of access a single hijacked session, token, or integration can touch before containment. That concept should now shape how teams think about detection, revocation, and blast-radius containment across human, NHI, and vendor access.

Operational trust will outlast policy trust unless controls are runtime-native: The article shows that compliance claims, MFA deployment, and vendor questionnaires all fail when they are detached from live behaviour. The discipline shift is toward proving what an identity did after login, which is where IAM, SOC, and third-party governance finally converge.

From our research library:

• 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
• Read next: Identity Security Programme Guide

What this signals

Identity blast radius will become a board-level operational metric: A successful login is no longer a meaningful end state if the resulting session can reach engineering, finance, or vendor-connected systems. Teams should measure how far a single identity can move before containment, because that is the real unit of exposure in a runtime-driven attack model.

Runtime-native governance is now the dividing line: Controls built for static verification will keep missing attacks that unfold through approved sessions and integrations. Identity programmes need telemetry that follows access after authentication, especially where human users, service accounts, and third-party connections share the same SaaS estate.

For practitioners

• Instrument post-login behaviour Correlate successful authentication with activity patterns, data access, and privileged actions so that anomalous behaviour is visible after the login event.
• Revoke sessions globally on drift Create a runbook for terminating active sessions, OAuth grants, and tokens when an identity starts acting outside its expected behavioural baseline.
• Treat third-party identities as live access paths Monitor vendor integrations, API tokens, and connected SaaS accounts with the same scrutiny used for internal privileged accounts.
• Shorten the time between anomaly and containment Automate alerts and response actions so suspicious identity behaviour is investigated and contained before data export or lateral movement completes.

Key takeaways

• The article’s central warning is that identity compromise now happens through trusted sessions, not just broken logins or malicious binaries.
• Its evidence points to a control gap that sits after authentication, where behavioural anomalies, vendor integrations, and SaaS workflows can still be abused.
• Practitioners should shift governance toward runtime visibility, global revocation, and identity blast-radius containment across human, NHI, and third-party access.

Key terms

• Session abuse: Session abuse is the misuse of an already established browser session to perform actions that were not intended by the legitimate user or system owner. It can include token theft, consent misuse, hijacked navigation, or post-authentication actions that bypass the original access decision.
• Runtime Vendor Risk: Runtime vendor risk is the exposure created by third-party identities, integrations, and tokens while they are actively operating in production. It shifts assurance away from static questionnaires and toward live observation of what a vendor connection is actually doing inside a tenant or workflow.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
• Post-Authentication Monitoring: Post-authentication monitoring is the practice of watching identity behaviour after a login, token exchange, or session start. It matters because successful authentication does not prove trustworthiness for the rest of the session, especially when attackers use valid credentials or trusted flows.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.