Identity Security | Breaking Cybersecurity News | The Hacker News

You cannot reliably predict what an AI agent is going to do. That is a feature, not a flaw.  When things go well, developers can save a lot of time and effort. When it goes wrong, it can be disastrous. For example, in April 2026, a Cursor agent working on a staging task for PocketOS encountered a credential mismatch, found an unrelated Railway API token with blanket GraphQL permissions , and used it to delete the production database and its volume-level backups in nine seconds.  Unlike deterministic scripts, which produce fixed outcomes given the same input, we use agents because they can take a loosely defined objective and determine the steps themselves. An agent can read context, choose tools, query systems, revise its plan, and take a path nobody explicitly programmed. Security teams can decide afterward whether those actions were acceptable, but fully enumerating them in advance is not only antithetical to using an agent but also practically impossible. On the ot...

Check your expanding identity attack surface Identity has become the new perimeter, and attackers know it. According to new research from CrowdStrike, 80% of modern cyberattacks are identity-driven , leveraging compromised credentials.  This substantial volume is driven by the widespread use of well-known directories such as Active Directory, and the vulnerabilities associated with compromised privileged accounts that are overprivileged or unmanaged, not network intrusion.  The explosion of privileged credentials and lack of adequate visibility or oversight can be attributed to growth, whether due to migration to the cloud, mergers and acquisition, the increased use of contractors, or simple organic business growth. This growth outpaces the ability to adequately govern the environment, leaving exploitable vulnerabilities.

Identity is the attack surface now. Most identity governance and administration (IGA) programs still run on manual certifications, static role models, and quarterly reviews that go stale the day someone signs off on them. That's not a compliance inconvenience for a CISO. It's a structural gap. Attackers don't wait for the next recertification cycle, so identity risk detection can't either. Autonomous identity governance turns IGA from a periodic, human-driven exercise into something that runs continuously, watching real usage, learning what normal looks like, and acting on deviations before they turn into incidents. That autonomy applies across every identity and entitlement placed under governance, continuously reassessing access as usage, roles, and risk signals change. Three things are colliding to force this shift. Identity sprawl across cloud and SaaS environments has grown past what manual reviews can realistically handle, service accounts and non-human identi...

A security leader at a global finance company told us recently that his team discovered three times more AI tools running in their environment than IT had approved. Nobody had smuggled them in. Employees had simply pointed agents at their work, and the agents brought their own tools with them. That conversation is not unusual. It is the conversation. Over the past year, in customer discussions across finance, healthcare, manufacturing, and government, the same four struggles come up so consistently that we have started treating them as the shape of the problem itself. Every company effectively hired a second workforce this year, human workers and agentic workers side by side, and the agentic workers never went through onboarding. No handbook, no scoped credentials, no acceptable-use policy they can actually read. Here is what teams are struggling with, what our research says about why, and what closing each gap actually requires.

We had an enterprise customer tell us their entire AI footprint was Copilot. That was the whole answer. One tool, one line item, done. We ran the first scan. Copilot wasn't even close to number one. Claude was. OpenAI came in second. Copilot was third. Nobody on the security team knew because Claude doesn't show up the way a SaaS app used to show up. There's no single login screen, no single admin console, no one place to look. That's the part most security teams miss. Claude isn't one surface. It's six. The six places Claude actually runs Claude Enterprise and Connected Apps. This is the surface everyone pictures: employees typing into Claude, OAuth'd into Google Drive, GitHub, Slack, and Jira, asking Claude to act on what's inside. The audit log shows that a connection happened. It does not show what got pulled into the prompt or what came back out. A finance analyst can drop a quarter of board materials into a conversation in ten second...

For a long time, the cybersecurity industry has framed social engineering as a psychological problem. We treat it as a battle of wits between a charismatic con artist and an unsuspecting employee. The prevailing wisdom says that if we just train our people to better identify scams or tear down malicious infrastructure slightly faster, we can stay ahead of scammers. But looking at the threat landscape from a purely threat-intelligence perspective tells us something entirely different: Modern social engineering is more than a psychological game. It's a highly optimized, industrialized deception economy. Attackers run campaigns like hyper-efficient businesses. They have Customer Acquisition Costs, operational budgets, and strict Return on Investment (ROI) targets. This is the part the industry doesn't like to sit with: If we want to truly break the social engineering attack chain , we have to stop focusing exclusively on building higher walls or executing reactive takedowns...

When I work on an incident, the first question I ask is almost never "what malware ran." It's "whose credentials did it use, and what was that account allowed to touch." Nine times out of ten, the interesting part of the story isn't the exploit. It's the access. The exploit gets you in the door. The privilege is what lets you walk through the building. For thirty years, that question had a human-shaped answer. A person clicked something, a person got phished, a person reused a password, an admin left a service account sitting on a domain controller with a password from 2014. The identity at the center of the incident belonged to somebody with a badge and a manager. That assumption is quietly dying, and most enterprises have not adjusted their controls to match. The actor on your network is increasingly not a person at all. It is a workload, a script, a bot, an API (application programming interface) client, and now an AI agent that can reason, plan...

Attackers prefer the path of least resistance. Why break in when you can log in? That is what makes working credentials so valuable. A leaked password, token, or API key does more than reveal sensitive data; it offers a way in. No vulnerability or privilege escalation chain necessary. If the credential is valid, the attacker can simply use it, and the session will look like ordinary activity. This shifts the questions from "where can attackers break in?" to "where do usable keys tend to accumulate? Increasingly, the answer is the developer laptop: one of the most instrumented machines most companies own, and one of the easiest places for credentials to go unnoticed. The endpoint is watched for malware, behavior, posture, and configuration. But a valid plaintext credential is something else: a door an attacker may not need to force. A fully patched fleet can still have usable keys scattered across its devices, enough to turn one foothold into something much larger....

Why Authentication Context Matters Most people think logging in is a small act. Type your password, type your code, tap a screen, scan a face, and move on. But to the systems on the other side, the method behind that moment can matter just as much as the fact that it happened at all. That is where two strangely named but surprisingly important identity concepts enter the story: OIDC's AMR and SAML 2.0's AuthnContext. They sound like the kind of acronyms that only standards committees could love, yet both were created to answer a deeply human question in digital form: How sure a system has to be before it trusts someone? The backstory starts with the internet growing up. Early online services often treated authentication as a light switch: either the user was in, or the user was out. But as online systems began handling payroll, health records, taxes, academic data, contracts, and financial approvals, that simple model started to crack. A login backed by a reused password is not ...

The most important cybersecurity impact of artificial intelligence is not that attackers can write better phishing emails or automate parts of their workflow. It is that AI is changing the speed, scale, and decision-making dynamics of cyberattacks.  That creates a problem many organizations have not yet fully confronted: most cyber governance and incident response models were designed for human-speed attacks.  For years, security teams operated under a familiar sequence. Detect suspicious activity. Investigate. Validate the threat. Escalate to leadership. Decide on containment. Communicate with stakeholders. That model still has value, but it assumes defenders have enough time to build confidence before taking material action.  AI-enabled attacks challenge that assumption.  Adversaries can now use AI to accelerate reconnaissance, generate highly personalized social engineering, modify malware, test payloads, summarize stolen data, identify vulnerabilities, a...

For years, our industry has treated "blocking" as the gold standard. If the email didn't land, if the malware didn't execute, if the alert fired in the SIEM, we called it a win. That mindset made sense in a world where most attacks came through a handful of familiar doors. But AI has changed the game. We're not dealing with hobbyists sending out clumsy phishing attacks anymore. Modern adversaries are running multi‑channel, AI‑assisted businesses at machine speed. And if all you're doing is blocking at the edge, you're not really defending. You're just delaying. Generative AI has made it trivial to spin up highly personalized, multi‑step social engineering campaigns that operate simultaneously across email, collaboration apps, mobile, social media, and paid media. The result is a social engineering attack chain : a sequence of stages designed to manufacture trust, erode judgment, and bypass brittle controls. You don't beat that by tuning another filter. You have to disrupt the at...

Modern attacks are not primarily defeating infrastructure. They are inheriting trust. Identity Did Not Become Important. It Became Infrastructure. Security teams still talk about identity as though it is one security discipline among many, sitting beside endpoint protection, cloud security, network defense, and vulnerability management. That framing no longer reflects how modern enterprises actually operate. Modern business environments run on identity, delegated trust, cloud roles, automation pipelines, APIs, machine permissions, and continuously exchanged credentials. Users authenticate into SaaS platforms that the organization does not own. Workloads assume permissions that nobody provisions manually. Services trust other services built across years of acquisitions, migrations, technical debt, and operational compromise. The enterprise is no longer running on infrastructure alone. It is running on identity. Attackers recognized this shift before many defenders did. That i...

The disclosure of CVE-2026-25177, a high-severity privilege escalation flaw in Microsoft Active Directory Domain Services, is a timely reminder that identity infrastructure remains one of the most consequential attack surfaces in the modern enterprise. Rated HIGH with a CVSS score of 8.8, this vulnerability allows an authenticated domain user to escalate privileges and move laterally across the network without elevated starting permissions or any user interaction. The mechanics are instructive. If a compromised account holds native Active Directory (AD) permission to modify Service Principal Names (SPNs), an attacker can create a duplicate SPN for a targeted service. When clients request Kerberos authentication, the domain controller may issue a ticket encrypted with the wrong key, causing a denial of service or forcing a fallback to the weaker NTLM protocol. No access to the targeted server is required beyond that initial SPN-write permission. In an environment where Active Directo...

For most managed service providers (MSPs), ransomware recovery is not a problem that affects one client at a time. It is a multitenant, high-pressure scenario where recovery failures impact multiple clients at once. Testing ransomware recovery is not just a technical exercise but a business-critical requirement. The green check of a successful backup job does not guarantee successful ransomware recovery. Attackers today do more than encrypt files. They compromise identity systems, alter configurations, and create persistence mechanisms that survive system restoration. So, a "clean" backup can still reintroduce dormant malware or broken dependencies into your environment. Recovery success depends on whether systems are usable, trusted and operational after restore, not whether data simply exists. Modern ransomware protection and recovery strategies require correlation between security events and backup data. Without that, MSPs are forced into guesswork across multiple cl...

Identity sprawl, agentic AI risk, and the path to NHI governance maturity When security leaders talk about identity risk, the conversation almost always centers on humans: Privileged users, compromised accounts, insider threats. But for most enterprises, the greater risk has already shifted. And it has nothing to do with your employees. Non-human identities (NHIs) — service accounts, API keys, OAuth tokens, SSH keys, RPA bots, cloud workload credentials and AI agents — are the fastest-growing, least-governed attack surface in the modern enterprise. And the industry is beginning to reckon with what that means. $4.88M Global average cost of a data breach — IBM Cost of a Data Breach 2024 The scope of the problem The numbers are striking. Research from Rubrik Zero Labs puts the NHI-to-human identity ratio at 45:1 in the modern enterprise. For cloud-native and DevOps environments, Entro Labs H1 2025 research puts that figure at 144:1.  These identities are not passive: They au...

As identity-based attacks continue to rise, the most damaging breaches increasingly begin with valid credentials rather than vulnerability exploits. That's why identity resilience will define the maturity of your cybersecurity in 2026.  A unified identity defense layer, combining privileged access management (PAM) with identity threat detection and response (ITDR), is emerging as the foundation of that resilience. This article explores why integrating these capabilities into your security strategy is no longer optional and how, together, they form the backbone of modern organizational security. The shift to identity-centric security Traditional PAM solutions that allow you to safely authenticate users are no longer enough to protect your business against modern threats. Instead of breaking through technical barriers, threat actors are now using compromised credentials to sign in as legitimate users. According to IBM's X-Force 2025 Threat Intelligence Index, identity-driven intr...

In most security operations centers, CVSS quietly dictates remediation priorities. Dashboards are sorted by severity. "Critical" vulnerabilities float to the top. Quarterly summaries celebrate how many 9.0+ findings were closed. On paper, it looks rational. In practice, it's often wrong. CVSS was designed to standardize how vulnerabilities are scored. Its origins and main purpose have been to measure technical severity, including exploit complexity, required privileges, impact on confidentiality, integrity, and availability. It provides a shared language. But where it has perpetually struggled is measuring context within, like whether the asset is internet-facing, how critical it is to the business, and whether attackers are actively exploiting the vulnerability. And context is where real risk lives. How Abstract Scores Turn Vulnerability Management Into "Severity Theater" A vulnerability scored 9.8 in a non-production environment with no external access may demand immediate atten...

The world of identity security is in constant motion. What was once a straightforward matter of usernames and passwords has evolved into a complex ecosystem of biometrics, hardware tokens, and zero-trust architectures. As we look toward 2026, the pace of change is only accelerating. The lines between our digital and physical identities are blurring, and the threat landscape is becoming more sophisticated. Chief Information Security Officers spend their days on the front lines of this evolution. Staying ahead isn't just about reacting to threats; it's about anticipating them to reduce risk. Based on the trends I'm seeing today, here are 9 identity security predictions for where we'll be in 2026. 1. AI will become the primary identity governance tool. Manual access reviews and role-based access control (RBAC) models are already showing their age. By 2026, AI-driven identity governance and administration (IGA) will be standard. These systems will continuously analyze u...

AI-powered browsers are changing how we use the web, but they're also creating some serious new security risks. Tools like Perplexity's Comet and Opera's Neon can summarize pages and automate tasks for you. The problem is that researchers have found these agentic copilots can be hijacked by malicious prompts hidden in ordinary webpages, essentially turning your browser against you. In August 2025, Brave's security team disclosed an indirect prompt injection against Perplexity's Comet using hidden instructions in a Reddit spoiler tag, leading Comet to extract an email address and a one-time passcode. No memory corruption, no code execution exploit. The browser simply followed instructions it couldn't distinguish from legitimate user intent. In this post, we'll look at how these attacks work, why they slip past traditional defenses, and what security teams can do to keep data safe from compromised AI agents. AI Browsers: Powerful, But a New Target AI-ena...

A 2024 Gartner® survey of 162 large enterprises shows organizations running an average of 45 cybersecurity tools. It's no surprise, then, that 52% of executives cite complexity as the biggest barrier to effective security operations. While mid-market organizations typically run fewer tools, smaller IT and security teams mean they often face equal—or greater—operational complexity. Why Security Platforms Emerged The industry's answer to tool sprawl has been the security platform: a consolidated approach designed to reduce complexity by replacing multiple point products. In principle, platforms promise tighter integration, improved visibility across the attack surface, better alert correlation, and faster response. Research supports this direction. The 2025 IBM Institute for Business Value report notes that organizations with higher security platform maturity identify and contain incidents more quickly. Consolidation Doesn't Always Equal a Platform Vendor consolidation is accelera...