Identity trust is under attack: are your authentication controls ready?

Identity trust, not network trust, is the primary battleground in this campaign. The advisory shows that adversaries no longer need to defeat perimeter controls when weak authentication, legacy protocols and mailbox permissions already provide a trusted path inward. That is a structural identity failure, not a perimeter failure. Practitioners should treat authentication design as a frontline security domain, not an administrative afterthought.

A question worth separating out:

Q: What should teams do when a legacy authentication protocol cannot be removed quickly?

A: Treat it as an exception with compensating controls, explicit ownership and a documented retirement plan. Limit where it is allowed, monitor its use closely and avoid extending it into new workflows that would deepen the identity risk gap.

👉 Read our full editorial: PKI authentication and NTLM deprecation define the identity risk gap