Identity Security: The Five Most Common Identity-Based Threats

Most attacks don't break in. They log in.

1 · Phishing and social engineering

Phishing is still the most common route to identity compromise, because it exploits human decision-making - and it is no longer just email. It shows up in SMS, collaboration tools, social media and phone calls, impersonating a supplier, a colleague or a support team. The convincing attempts do not rely on perfect spelling; they rely on believable context and urgency.

The real risk is not only a password typed into a fake page - it is a business process manipulated: bank details changed on an invoice, an approval pressured through, a mailbox takeover used to target others internally. The strongest defence pairs verification habits with sensible controls: confident reporting of suspicious messages, a second channel to confirm sensitive requests, tighter sign-in controls, and clear separation of duties.

2 · Credential stuffing and password reuse

When credentials are exposed in a data breach - and billions have been - attackers test them automatically across other services. If someone uses the same password for a personal account and a work system, that exposure becomes your risk.

Credential stuffing attacks are automated, fast, and difficult to distinguish from legitimate sign-in attempts at volume. Organisations without multi-factor authentication, sign-in risk policies, or anomalous login detection are particularly exposed. The mitigation is layered: MFA, conditional access, password manager adoption, and identity protection tooling that flags unusual patterns before they become incidents.

3 · MFA fatigue and push bombing

Multi-factor authentication significantly raises the bar for attackers - but it does not eliminate it. Push bombing works by sending repeated MFA prompts to a user's device until they approve one, either out of genuine confusion or frustration. Some attackers combine this with a phone call impersonating IT support, creating pressure to accept.

The answer is not to remove MFA - it is to move to number matching and additional context in push notifications, or to phishing-resistant methods like passkeys and hardware tokens. These make it much harder to approve a fraudulent request accidentally.

4 · Privileged account compromise

Accounts with elevated permissions - global administrators, security administrators, billing roles - are disproportionately valuable to attackers. They can move laterally, exfiltrate data, establish persistence, or cause significant damage quickly. And they are often less carefully managed than they should be: standing permissions that are never reviewed, shared credentials, legacy accounts that were never deprovisioned.

Privileged identity management means applying just-enough, just-in-time access - roles that are activated for specific tasks and expire, rather than assigned permanently. Combined with strong authentication requirements for privileged roles and regular access reviews, this significantly reduces the blast radius if an account is compromised.

5 · Insider risk and accidental data exposure

Not all identity-related incidents are malicious. Overly permissive sharing settings, misconfigured SharePoint sites, and broad group memberships mean that data is often accessible to far more people than intended. When someone leaves the organisation, their access may not be revoked promptly - or at all.

Insider risk management is not primarily a disciplinary tool. It is about understanding how information moves through your organisation, identifying unusual patterns, and making sure that when people do leave, access is cleanly removed. It also means regular review of who has access to what - particularly for sensitive data - and building the controls that prevent accidental exposure in the first place.

Building a stronger identity posture

Identity security is not a single control - it is a practice. The organisations that do it well have a consistent approach across authentication, access management, monitoring, and response. They know what their normal looks like, so they can spot what is not.

We help organisations assess their current identity posture, prioritise the gaps that carry the most risk, and build a roadmap to address them - whether that is deploying Entra ID Protection, implementing conditional access policies, or running a privilege review. The goal is a posture that is demonstrably stronger and continuously maintained.