Topic starter
02/08/2026 11:54 am
TL;DR: Identity-based attacks will exceed 60% of successful breaches in 2026, with attackers relying on stolen credentials, session abuse, OAuth grants, and SaaS-to-SaaS lateral movement instead of malware, according to Exaforce. The operational shift is clear: authentication alone no longer defines trust, and post-login behaviour now matters more than the front door.
Editorial analysis by NHI Mgmt Group, based on content published by Exaforce: “7 predictions for the security landscape in 2026”.
By the numbers:
- Identity-based attacks will officially exceed 60% of all successful breaches by 2026, according to Exaforce.
Key questions
Q: What breaks when attackers can steal MFA session tokens?
A: MFA stops being the control point once the attacker has a valid token or cookie.
Q: Why do OAuth sessions create more risk than traditional login events?
A: OAuth sessions can carry trust forward after the initial authentication step, which means one successful approval can unlock access across multiple services.
Q: How should security teams detect abuse when attackers use legitimate identities?
A: Security teams should correlate successful authentication with downstream behaviour such as unusual file access, privilege escalation, bulk export, and lateral movement.
Practitioner guidance
- Instrument post-login behaviour Correlate successful authentication with activity patterns, data access, and privileged actions so that anomalous behaviour is visible after the login event.
- Revoke sessions globally on drift Create a runbook for terminating active sessions, OAuth grants, and tokens when an identity starts acting outside its expected behavioural baseline.
- Treat third-party identities as live access paths Monitor vendor integrations, API tokens, and connected SaaS accounts with the same scrutiny used for internal privileged accounts.
Bottom line: The article’s central warning is that identity compromise now happens through trusted sessions, not just broken logins or malicious binaries.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:02 pm
Identity trust has moved from a login event to a runtime decision: The article is right that authentication alone no longer defines trust, because attackers increasingly operate through valid sessions, tokens, and SaaS permissions. That shifts the governance problem from identity proof to identity behaviour, which is a materially different control question. Programmes that stop at the gate are measuring entry, not risk.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What should organisations change when third-party risk depends on runtime behaviour?
A: They should move from document-based assurance to live monitoring of third-party identities, tokens, and integrations. The practical question is whether a vendor connection is behaving inside its expected scope today, not whether it passed a questionnaire months ago. Runtime evidence must drive containment and review.
👉 Read our full editorial: Identity attacks, session abuse, and vendor risk will dominate 2026