Topic starter
19/08/2026 4:06 pm
TL;DR: Identity remained the most targeted attack surface in Expel’s 2026 Annual Threat Report, which says 68.6% of incidents it saw in 2025 involved identity as the primary entry point; the report also argues security teams need to translate control success into business risk and dollars, not just block counts, according to Expel. That framing matters because stronger identity controls change the meaning of an incident, not the need for governance.
Editorial analysis by NHI Mgmt Group, based on content published by Expel: “Spoiler alert: Cybersecurity has never been about the attacks”.
By the numbers:
- 68.6% of all the incidents Expel saw in 2025 involved identity as the main attack surface.
Key questions
Q: What breaks when identity controls stop an attack but the business still sees it as a near miss?
A: The measurement model breaks.
Q: Why do identity attacks matter so much even when MFA and passkeys are in place?
A: Because strong authentication changes attacker methods, not attacker interest.
Q: How can security teams know whether identity controls are actually reducing breach impact?
A: Look for evidence that suspicious accounts are contained fast, active sessions are terminated, and privileged access is limited to the smallest possible set of systems.
Practitioner guidance
- Translate identity incidents into loss metrics Map blocked logins, resets, and takeover attempts to estimated downtime, fraud exposure, and remediation cost so executive reporting reflects business impact, not only security activity.
- Instrument identity-layer control outcomes Track whether SSO, MFA, passkeys, and conditional access are reducing successful compromise and shortening containment time, then report those outcomes alongside incident counts.
- Separate blocked attempts from true compromise Classify password exposure, blocked access, and confirmed account takeover differently so teams do not overstate incident severity or understate control effectiveness.
Bottom line: Identity attacks remain central because valid access still offers attackers the fastest route through trusted systems.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
19/08/2026 4:39 pm
Identity is now a business-risk control point, not just an authentication layer. Expel's report reinforces a point many teams still understate: identity controls change loss potential, not merely access success rates. When SSO, MFA, and passkeys stop an attack, the meaningful outcome is reduced business exposure, not a higher block count. Practitioners should report identity performance in terms leaders can use for risk decisions.
A question worth separating out:
A: When the blocked attempt would have reached sensitive data, privileged workflows, or revenue-critical applications if it had succeeded. In those cases, the incident should feed risk and finance reporting, because the value of the control is the harm it prevented, not the alert it generated.
👉 Read our full editorial: Identity attacks remain the top incident surface in Expel's 2026 report