Over the past decade, companies have replaced firewalls with identity platforms, on the reasoning that once work moved to the cloud, the login became the front door. Secure the credentials, the logic went, and the business is secure.
Attackers did not wait for that architecture to mature. They found it simpler to use credentials that were already available to them.
The numbers bear this out. Identity weaknesses played a role in nearly 90% of security incidents last year, and identity-based techniques—phishing, stolen credentials, brute force, insider misuse—accounted for 65% of initial access, according to Unit 42’s Global Incident Response Report 2026. Verizon’s 2025 Data Breach Investigations Report found stolen credentials behind 22% of confirmed breaches overall, and 88% of basic web application attacks specifically.
These figures point less to a technology gap than to a defense misaligned with how attackers actually gain entry.
The Tools Are in Place, but the Breaches Have Not Slowed
The more troubling finding for any organization with an identity security budget: SANS’s 2026 State of Identity Threats & Defenses Survey found that 85% of organizations have deployed identity security tools, yet 55% still experienced an identity-related compromise in the past year. Investment in the problem and resolution of the problem remain two separate outcomes.
According to SANS, attackers have largely stopped trying to defeat authentication and instead use it as intended. Credential phishing still accounts for roughly a third of attacks, but compromised browsers, MFA fatigue, and stolen session tokens now represent a comparable share. A stolen session cookie does not need to defeat multi-factor authentication, since it grants access after authentication has already occurred.
This is the distinction worth noting in “identity is the new perimeter.” A perimeter implies a boundary. What most organizations have instead is a login process that grants access to anyone presenting a valid token, regardless of how that token was obtained.
Where the Credentials Originate
Infostealer malware has become the primary supply chain for this problem. SpyCloud’s 2026 Identity Exposure Report recaptured 8.6 billion stolen session cookies and more than 642 million credentials from 13.2 million infostealer infections in a single year, contributing to a criminal data lake that has grown to 65.7 billion identity records. Forty percent of those infections occurred on endpoints running EDR or antivirus software, indicating that detecting the malware after infection does not reverse the theft that already took place.
The exposure extends beyond human employees. Non-human identities—API keys, service accounts, machine credentials—continue to accumulate access that is rarely audited. CrowdStrike’s CISO’s Guide to the Cloud Threat Landscape recorded a 136% increase in cloud intrusions in the first half of 2025 compared to all of 2024, with valid account abuse responsible for 35% of them.
What Warrants Attention
These findings do not argue for acquiring another identity platform. They argue for treating existing platforms as incomplete solutions. A few priorities follow directly from the data:
Reduce the interval between compromise and detection. IBM’s Cost of a Data Breach report places the average cost of a credential-based breach at $4.67 million, with a 246-day average time to identify and contain it. That is roughly eight months during which an attacker operates with legitimate-looking access.
Treat session tokens with the same rigor as passwords. If a stolen cookie provides equivalent access to a login, session expiration and token revocation need to be enforced with comparable discipline.
Audit machine identities on the same schedule as employee access. A decommissioned API key rarely receives the equivalent of an exit interview.
The Takeaway
The perimeter shifted to identity because that is where the value resides, and attackers have followed accordingly. Deploying an identity tool is not the conclusion of that work. It is the point at which the work begins.
