An annual threat landscape report finds that stolen identities remain the most common way attackers get into organisations.
Credential phishing and session-cookie theft account for about half of the incidents studied, while abuse of cloud access tokens rose 41% compared with last year.
The authors say phishing-resistant sign-in and short-lived tokens now prevent more attacks than any single network control.
What to do
- Move administrators to phishing-resistant sign-in first.
- Shorten token lifetimes and review long-lived API keys.