Notifications
Clear all
Topic starter
02/08/2026 11:54 am
TL;DR: Identity-based attacks will exceed 60% of successful breaches in 2026, with attackers relying on stolen credentials, session abuse, OAuth grants, and SaaS-to-SaaS lateral movement instead of malware, according to Exaforce. The operational shift is clear: authentication alone no longer defines trust, and post-login behaviour now matters more than the front door.
NHIMG editorial — based on content published by Exaforce: 7 predictions for the security landscape in 2026
By the numbers:
- Identity-based attacks will officially exceed 60% of all successful breaches.
Questions worth separating out
Q: How can security teams tell whether adaptive MFA is working properly?
A: Look for a lower challenge rate on routine sessions, a higher challenge rate on suspicious transactions, and stable or improved conversion.
Q: Why do trusted sessions create more risk than failed logins?
A: Because failed logins are noisy and visible, while trusted sessions let attackers operate inside normal workflows.
Q: What do security teams get wrong about third-party access management?
A: They often focus on initial provisioning and underestimate the risk of stale access.
Practitioner guidance
- Instrument post-authentication behaviour across SaaS and cloud Track what users and integrations do after login, including unusual exports, unusual admin actions, and cross-application activity that fits no normal baseline.
- Review delegated OAuth grants and third-party integrations Identify apps and connectors with excessive scope, stale ownership, or broad access to engineering, finance, or customer data.
- Shorten containment time for suspicious identity activity Define automated revocation paths for sessions, tokens, and linked accounts so abnormal behaviour can be blocked before lateral movement completes.
What's in the full article
Exaforce's full blog post covers the operational detail this post intentionally leaves for the source:
- The full explanation of each 2026 prediction, including the specific identity patterns behind the trend.
- Examples of the runtime behaviours security teams should watch for in SaaS, cloud, and third-party integrations.
- The article's own view of how compliance, SOC workflows, and incident response priorities are expected to shift.
- The closing operational framing on how to measure containment, trust, and behavioural drift in practice.
👉 Read Exaforce’s 2026 security predictions on identity attacks, MFA, and third-party risk →
Identity attacks and runtime vendor risk: are your controls keeping up?
Explore further
02/08/2026 1:02 pm
Identity assurance at login is no longer a sufficient control boundary. The article is right that attackers now operate inside trusted sessions, which means authentication success does not equal security success. That breaks the old assumption that the front door defines the risk boundary. Practitioners should treat post-authentication behaviour as the real governance problem.
A few things that frame the scale:
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap.
A question worth separating out:
Q: Who is accountable when identity-based attacks move through SaaS integrations?
A: Accountability sits with the organisation that granted and failed to monitor the access path. Security, IAM, and application owners need a shared view of delegated scope, revocation ownership, and alert handling because third-party access becomes part of the internal identity model as soon as it is live.
👉 Read our full editorial: Identity attacks, session abuse, and vendor risk will dominate 2026
