Topic starter
23/10/2026 12:46 am
TL;DR: Credential theft, session hijacking, and business email compromise can all hide inside successful sign-ins, Blackpoint Cyber says. Identity telemetry has to re-evaluate trust after login if teams want suspicious sessions, grants, and inbox rules caught before damage spreads.
Editorial analysis by NHI Mgmt Group, based on content published by Blackpoint Cyber: “Is Identity Threat Detection Already a Gap in Your Security Stack?”.
By the numbers:
- Microsoft reported a 32% surge in identity-based attacks in the first half of 2025.
- More than 97% of identity attacks are password attacks, according to Microsoft’s Digital Defense Report 2025 cited by Blackpoint Cyber.
Key questions
Q: Why do valid credentials and session tokens remain such an effective attack path?
A: Because they let attackers operate inside trusted access paths instead of breaking in noisily.
Q: How do you know if identity threat detection is actually working?
A: Look for shorter mean time to detect and mean time to respond, plus fewer incidents where suspicious sessions persist for hours.
Q: What breaks when a security stack relies on MFA but does not monitor identity behaviour after login?
A: The control fails at the point where authentication succeeds but trust should be re-evaluated.
Practitioner guidance
- Instrument post-authentication identity telemetry Alert on unusual sign-in geography, unexpected hours, suspicious infrastructure, and active sessions that move from their origin point.
- Track mailbox and grant abuse signals Monitor new inbox rules, auto-forwarding changes, deletions, and OAuth grants as indicators of account takeover rather than nuisance noise.
- Separate detection from prevention in your control design Validate that your programme can detect a misused valid credential after MFA succeeds, not just block unauthorised logins.
Bottom line: A mature stack can still leave identity abuse visible only after the attacker is already inside the account.
Glossary terms: Identity Threat Detection and Response, Session Hijacking, OAuth Grant Abuse, Business email compromise
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
23/10/2026 9:49 am
Identity misuse is now a post-authentication problem, not a perimeter problem. Once a valid credential gets through IAM or MFA, the security question changes from access approval to misuse detection. That shift matters because most control stacks still treat authentication success as the end of the identity decision. Practitioners need to govern the session, not just the login.
A question worth separating out:
Q: What should teams do immediately when they confirm a compromised cloud identity?
A: They should terminate active sessions, suspend the account, force a credential reset, and review linked grants or inbox rules before the attacker completes follow-on actions. The goal is containment before the compromise expands into payments, data access, or business email compromise.
👉 Read our full editorial: Identity threat detection is the missing gap in mature stacks
This post was modified 6 days ago by NHI Mgmt Group