Why existing cybersecurity controls are falling short for AI and MFA

At a glance

What this is: INTIGRITI’s trend analysis says remote work, AI-enabled abuse, and adversary focus on MFA and EDR are widening the gap between attacker speed and existing controls.

Why it matters: IAM, PAM, and security teams need to recheck how phishing-resistant authentication, device trust, and endpoint detection fit together as hybrid work and AI-driven attacks change the operating model.

Context

Hybrid work changes the security boundary because access is no longer concentrated on a single corporate network. That makes authentication, device state, and user behaviour harder to govern with controls designed for an office perimeter, especially when AI lowers the cost of phishing and malicious code generation.

The article frames the problem as a control mismatch: organisations have adopted MFA and EDR widely, but adversaries are adapting around both. For identity and endpoint programmes, the question is less whether to deploy these controls and more whether they remain resilient against modern abuse patterns.

Key questions

Q: What should organisations do when users work around MFA or other access controls?

A: Treat workarounds as evidence that the control design is not aligned with user behaviour. Re-examine friction, recovery paths, and helpdesk dependency, then simplify the authentication flow before tightening policy language. A control that users evade at scale has already weakened the programme.

Q: Why do AI-driven attacks make trust controls harder to maintain?

A: AI-driven attacks are harder to maintain against because they adapt faster than static controls and can be personalised at scale. That changes the defender's job from matching known patterns to continuously validating identity behaviour, trust signals, and response accuracy across multiple channels.

Q: What breaks when endpoint detection is evaded?

A: When EDR is bypassed, defenders lose visibility into process activity, lateral movement, and post-compromise behaviour on the device. That weakens containment, slows investigation, and can leave a compromised endpoint functioning as a hidden entry point until other controls notice the abuse.

Q: Should remote work security prioritise user authentication or device assurance first?

A: They should be treated together, but device assurance becomes critical once access leaves the office perimeter. A strong login proves little if the endpoint is unmanaged, unhealthy, or already compromised, so policy should combine authentication strength with device posture before granting access.

Technical breakdown

Why non-phishing-resistant MFA still fails

Multi-factor authentication reduces risk, but it does not eliminate credential abuse when the factor can be relayed, replayed, or socially engineered. Non-phishing-resistant MFA depends on the user recognising the attack and rejecting it, which is a weak assumption when adversaries use push fatigue, real-time phishing kits, or session theft. Once an attacker reaches a valid session, downstream controls often treat that session as trusted. The result is that authentication strength on paper can still leave a viable path into enterprise systems.

Practical implication: move high-risk users and systems to phishing-resistant authentication rather than relying on generic MFA everywhere.

How AI changes phishing and malicious code generation

AI changes the economics of abuse by reducing the effort required to personalise lures, generate convincing text, and produce repetitive malicious artefacts. That does not mean AI is the root cause of compromise, but it does lower the cost of scale for attackers who already understand how identity and trust failures work. The article also reflects a second-order risk: organisations adopting AI systems must consider AI-specific threats, not just traditional user-facing abuse. In practice, AI expands both offensive speed and the need for stronger governance over how systems generate or consume content.

Practical implication: treat AI-assisted phishing and code generation as acceleration factors that increase the value of stronger identity and content controls.

Why EDR evasion turns endpoint trust into a moving target

EDR is designed to detect suspicious activity on endpoints, but attackers keep adapting to minimise telemetry, disable agents, or blend into legitimate processes. That creates a control asymmetry: the defender assumes visibility will be durable, while the attacker seeks brief windows where the endpoint can be manipulated or silenced. In hybrid environments, that problem is amplified because devices are dispersed and not always continuously managed. The security model therefore depends not just on having EDR, but on whether the surrounding identity and device trust model can tolerate partial visibility.

Practical implication: pair endpoint controls with strict access decisions so a compromised or untrusted device cannot freely inherit enterprise trust.

Threat narrative

Attacker objective: The attacker wants to turn user trust, weak authentication, and endpoint blind spots into durable access that can be monetised or used for broader intrusion.

1. Entry begins with AI-assisted phishing or other credential theft methods that target users operating outside a controlled office perimeter.
2. Credential use or session abuse then bypasses weaker MFA implementations, especially where authentication is not phishing-resistant.
3. Attackers escalate by evading endpoint detection or by using the obtained access to move into higher-value systems and data.
4. Impact comes from wider account compromise, harder-to-detect persistence, and increased exposure to fraud, theft, or operational disruption.

Breaches seen in the wild

• CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.
• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

MFA is not a governance endpoint, only a control point. The article shows that authentication strength only matters when the factor itself is resistant to phishing and session abuse. Once organisations treat MFA as a checkbox, they leave a policy-shaped gap that attackers can still route through. The practitioner conclusion is that assurance must move from generic MFA adoption to phishing-resistant authentication for the workflows that matter most.

Hybrid work has turned device trust into part of identity governance. When users connect from unmanaged or semi-managed environments, authentication no longer tells the whole story about access risk. That means identity teams cannot separate login controls from endpoint posture and device assurance. The practitioner conclusion is that access policy has to account for where and how the session is created, not just who signs in.

AI accelerates abuse faster than most control refresh cycles. The article’s AI discussion is not about novelty, but about scale. Attackers can generate more convincing lures and more code with less effort, which compresses the defender’s reaction time. The practitioner conclusion is that controls must be evaluated against attacker throughput, not just against yesterday’s tactics.

EDR evasion is a visibility problem before it is a tooling problem. When attackers can sidestep endpoint telemetry, the organisation loses the data it depends on for detection and response. That makes endpoint defence brittle if it stands alone. The practitioner conclusion is to design for degraded visibility and assume some endpoints will be partially observable at any given time.

What this signals

Hybrid work has effectively made identity policy session-aware. Access decisions now depend on more than a username and MFA prompt because the endpoint, network location, and session context all influence whether trust is justified. That means access governance has to incorporate device posture and session risk rather than assuming the perimeter still does the work.

AI-assisted abuse compresses defender reaction time. As phishing and malicious code become cheaper to produce, security teams should expect more attempts per attacker and more variation in each campaign. The practical response is to make identity verification, device trust, and alert triage more resilient to scale rather than counting on manual scrutiny alone.

Phishing-resistant authentication is becoming the practical dividing line. The article points to a world where generic MFA is no longer enough for high-risk access, especially when attackers can target recovery, session handling, or push-based approval flows. Teams should re-evaluate where passkeys, hardware-backed factors, and tighter recovery controls belong in the access model.

For practitioners

• Prioritise phishing-resistant MFA for high-risk access Use hardware-backed or passkey-based authentication for privileged users, remote access, and high-value systems where session compromise would be costly.
• Tie access decisions to device trust signals Require device health, management state, and endpoint compliance as inputs to access policy so compromised or unmanaged devices do not receive the same trust as corporate-managed endpoints.
• Review MFA bypass paths and session abuse risks Test for push fatigue, token theft, relay attacks, and session hijacking in the authentication flow, then close the paths that remain after login.
• Harden detection against EDR evasion Assume adversaries will target endpoint visibility and make sure detection logic, logging, and response playbooks still work when endpoint telemetry is incomplete.
• Add AI abuse scenarios to awareness and response plans Include AI-generated phishing, automated reconnaissance, and rapid malware content creation in user training and incident exercises so teams rehearse the newer abuse patterns.

Key takeaways

• Hybrid work, AI-enabled abuse, and endpoint evasion are forcing security teams to treat identity, device, and detection as one connected control problem.
• The article’s core warning is that MFA and EDR remain useful, but they are increasingly targeted by attackers who adapt faster than traditional security refresh cycles.
• Practitioners should focus on phishing-resistant authentication, device trust, and degraded-visibility response plans rather than assuming existing controls will keep pace on their own.

Key terms

• Phishing-Resistant Authentication: Phishing-resistant authentication proves identity without relying on a user to approve a prompt or reveal a reusable secret. It typically binds access to a device, key, or cryptographic proof that an attacker cannot easily reuse or coerce. This approach reduces reliance on human judgment at login time.
• Endpoint Detection and Response: Endpoint detection and response is security software that monitors individual devices for suspicious activity, investigates threats, and supports containment actions. It is designed for persistent hosts such as laptops and servers, where an agent can collect telemetry over time and give responders visibility into process, file, and network behaviour.
• Hybrid Attack Surface: A hybrid attack surface is the combined set of exposed systems across on premises infrastructure, cloud workloads, remote sites, and connected devices. It is harder to defend because trust boundaries are less visible and communication paths are more diverse. Segmentation helps reduce exposure by controlling which systems can talk to each other.
• AI-assisted phishing: AI-assisted phishing is social engineering where generative models help create more convincing, tailored, or higher-volume lure content. The risk is not only better wording, but faster iteration, which lets attackers adapt messages until they evade filters or persuade a target to act.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity, and secrets management for practitioners who need to connect identity controls to operational risk. It helps security teams translate identity assurance into better access decisions across modern environments.