How stolen identities, trusted tools, and compressed attack timelines are reshaping cyber defense
The idea of a hardened network perimeter has been fading for years. Today, the bigger issue isn’t necessarily someone breaking through a firewall: it’s someone logging in with legitimate credentials.
Attackers have streamlined how they steal and reuse usernames, passwords, session tokens, and MFA approvals. Instead of exploiting software vulnerabilities first, they often begin by compromising a real user account. Once inside, they blend in with normal activity, making traditional endpoint tools and perimeter defenses less effective at detecting initial access.
Identity has become both the entry point and the camouflage.
Malware-free activity becomes the norm
One of the defining security trends of 2026 is the continued rise of malware-free activity. Seventy-nine percent of detections are now reportedly malware-free, up from 40% in 2019. That increase reflects a strategic adaptation by attackers: custom malware may trigger endpoint detection and response tools, while legitimate administrative utilities are already trusted inside the environment.
Instead of introducing obviously malicious files, attackers increasingly “live off the land,” using tools such as PowerShell, Windows Management Instrumentation, and remote monitoring and management software. These programs have legitimate administrative purposes, so their use may not look suspicious on its own.
That is the central challenge. Defenses built to identify bad files can miss bad behavior carried out with good tools.
Valid account abuse now enables a significant share of intrusions. The IBM X-Force Threat Intelligence Index 2025 also identifies valid accounts as a leading entry vector alongside exploitation of public-facing applications. Once an attacker has working credentials, they may no longer need to defeat the perimeter in a recognizable way. They can simply authenticate.
A growing credential economy makes that access easier to obtain. Stolen usernames, passwords, browser cookies, and authentication tokens are packaged and sold through underground marketplaces. Attackers can purchase access harvested through phishing campaigns, infostealer malware, or prior breaches and begin operating inside an environment without exploiting a software vulnerability themselves.
Access may also be resold. During incident response, it is not uncommon to remove one threat actor only to discover others operating in parallel with different tools. Defenders may be dealing with a layered compromise, not a single intrusion.
What we see during real-world testing
Across healthcare, higher education, and manufacturing environments, we regularly see strong investments in EDR, XDR, and MDR platforms. That is meaningful progress, but tooling alone does not equal protection.
During penetration tests, the effectiveness of these platforms depends heavily on telemetry quality, configuration consistency, and the organization’s understanding of its own environment. Many teams do not have enough time or dedicated staff to tune and maintain their tools continuously. Recommendations therefore have to reflect the capacity of the people expected to carry them out.
We routinely see similar security stacks behave very differently across client environments. In one organization, a known credential-extraction technique may be blocked and reported immediately. In another using the same underlying platform, the activity may proceed without a visible alert reaching the security team.
The difference is often not the logo on the product. It is whether the right signals are collected, correlated, tuned, and monitored.
When noisy tools are blocked, attackers adapt. Built-in utilities designed for legitimate administration can be repurposed to gather directory information, access protected data, or move through the environment without introducing an unfamiliar binary.
The same is true of trusted defensive software.
When trusted software becomes the threat
Attackers increasingly repurpose digital forensics and incident response tools because those tools are designed to reach sensitive system artifacts. They may be signed, approved, and allowlisted precisely because defenders rely on them.
During penetration testing, for example, antivirus or EDR may successfully block a known malicious payload or credential-dumping utility. But a legitimate forensic tool such as KAPE—used by defenders to collect artifacts from memory, registry hives, and protected system locations—may still retrieve sensitive data with less scrutiny.
From an attacker’s perspective, there is little reason to upload custom malware if trusted software can produce the same result.
This does not mean organizations should block every administrative or forensic tool. It means they must monitor how trusted tools are used, by whom, from where, and in what sequence.
A utility that is appropriate during an approved investigation may be dangerous when launched unexpectedly by a newly authenticated user. Context matters more than the file name.
Permission drift creates hidden attack paths
Weak, reused, and aging credentials remain reliable ways into an environment—not because organizations have never heard of the problem, but because old access often becomes invisible through familiarity.
During a recent engagement, we found an IT help desk group with broad control over a service account. The account was not a Domain Admin, so it did not initially appear especially dangerous. But it still retained directory replication permissions.
After a help desk user fell for a phishing email, we were able to reset the service account’s password without triggering an alert and perform a DCSync, retrieving credentials for every domain-joined account. At that point, the compromise was effectively complete.
The client believed the service account was used only to send internal notification emails. Over time, responsibilities had changed and permissions had accumulated, but no one had revisited the access.
That pattern is common. High-impact compromises often involve familiar accounts that are assumed to be safe and quietly become over-permissioned.
Most organizations are not ignoring the issue. They are busy. Environments expand, cloud platforms are introduced, employees leave, vendors receive access, and new administrators inherit systems they did not build. In a large network, it can take years to understand fully how identities, applications, infrastructure, and permissions interact.
Permission drift is not simply a failure of discipline. It is an operational consequence of complexity.
Identity reviews therefore have to go beyond a list of privileged users. Organizations need to understand what accounts can actually do, which permissions are inherited, where service accounts retain legacy authority, and which combinations of access create paths to critical systems.
MFA is necessary, but no longer sufficient
Multi-factor authentication remains one of the most important security controls available. But attackers have adapted to its widespread adoption.
Modern phishing campaigns can proxy authentication sessions in real time. Instead of stealing only a password, the attacker captures the authenticated session token created after the user completes MFA.
During testing, this can be demonstrated using tools such as Evilginx. The user reaches what appears to be a normal login flow, submits valid credentials, and approves the MFA request. The authentication is relayed to the legitimate service while the resulting session token is intercepted. The attacker may then reuse that token without completing MFA again.
Device-code phishing presents a related problem. A user is directed to a legitimate authentication portal and asked to enter a short verification code. The page itself may be real, but the code authorizes the attacker’s session. Because the interaction occurs on a trusted domain, many traditional phishing cues are absent.
These techniques expose the limits of treating MFA as a finished project. MFA can stop many credential-based attacks, but organizations also need controls that evaluate the device, location, session, application, and risk surrounding the authentication.
Employees should be taught to question unexpected authentication prompts, device-code requests, and login instructions even when the page looks legitimate. Strong email security can reduce how often these requests reach users, but prevention should be paired with conditional access, session monitoring, phishing-resistant authentication, and clear processes for reporting suspicious prompts.
Attack timelines are collapsing
The shift toward identity-based attacks has also compressed breakout time: the period between initial access and movement into another system.
Recent reporting places the average breakout time at approximately 48 minutes, with the fastest observed breakout occurring in 51 seconds. The operational lesson is clear: attackers are moving faster.
With valid credentials, an attacker can begin mapping the environment almost immediately. Tools such as BloodHound can identify group memberships, delegated permissions, trust relationships, and privilege paths that may not be apparent to the internal team.
What once required days of manual exploration can now be surfaced in minutes.
When we gain internal access during a penetration test, we do not immediately try to “break” everything. We start by looking around. Enumeration is the process of learning how the environment is connected: systems, users, groups, services, permissions, and trust relationships.
A basic user account is often enough to begin. Within minutes, an attacker may be able to identify directory structure, exposed services, high-value systems, and potential paths to elevated access.
Penetration testers deliberately slow themselves down. We document each action, capture screenshots, record timestamps, and remain within the agreed scope. Real attackers do not.
That difference creates a dangerous illusion. A tabletop exercise or investigation may unfold over hours, while the underlying attack path could be traversed in minutes. A detection workflow that requires an alert to wait in a queue, receive initial triage, and then move to an analyst may not interrupt an automated attacker quickly enough.
Certain identity weaknesses can compress the timeline even further. Misconfigured Active Directory Certificate Services, for example, can sometimes allow an attacker to escalate privileges or impersonate another identity without deploying malware or triggering an obviously destructive event.
These attacks are especially difficult for security teams because they may resemble routine authentication activity. The underlying action is malicious, but the mechanism is legitimate and trusted.
Similar risks arise when administrative roles remain permanently active, service accounts retain unnecessary privileges, or trusted systems can authenticate broadly across the environment.
Organizations cannot rely only on detecting an attacker after access has expanded. They must reduce the number of available paths.
Just-in-time privileged access can help by making elevated permissions temporary and approval-based rather than continuously available. Conditional access can restrict authentication based on risk, device state, location, or application. Segmentation can limit how far one compromised identity can move.
No single control eliminates identity risk, but reducing standing privilege can materially slow an attacker and give defenders more time to act.
Edge devices remain a blind spot
Identity may be the primary entry point, but perimeter technology has not stopped mattering.
Last year, one client delayed patching a VPN appliance by 24 hours. That window was enough for attackers to obtain credentials, enter the environment, and establish a foothold without detection.
As organizations have strengthened endpoint visibility, attackers have increased their focus on systems that cannot support a traditional endpoint agent: VPN appliances, firewalls, gateways, and other edge devices.
The Verizon Data Breach Investigations Report found a significant increase in exploited vulnerabilities affecting edge devices. These devices occupy a sensitive position. They authenticate users, broker remote access, and often operate with elevated trust. When compromised, they may provide access to traffic, credentials, or the internal network while offering limited forensic visibility.
Security teams often monitor endpoints and identities closely while assuming the appliance itself is handling the perimeter. But an edge device cannot be treated as both the control and the proof that the control is working.
It must be patched quickly, externally tested, monitored where possible, and segmented so that one appliance cannot provide unrestricted access to the broader environment.
What defenders should prioritize
Identity-based attacks are difficult because they exploit legitimate access, trusted software, and ordinary administrative behavior. The answer is not to buy one more tool and assume the problem is solved.
Organizations should begin with five practical priorities.
- Reduce standing privilege. Review administrative and service accounts, remove unnecessary and inherited permissions, and use time-limited privileged access where possible.
- Treat identity and trusted-tool use as part of the detection surface. Monitor authentication, session behavior, privilege changes, OAuth grants, device-code activity, and administrative-tool use—not just malware and endpoint alerts. Tune detection around the sequences attackers follow.
- Test what happens after credentials are compromised. Assumed-breach testing can show how quickly a normal account can enumerate the environment, escalate access, and reach critical systems.
- Strengthen MFA rather than treating it as complete. Move toward phishing-resistant methods, pair MFA with conditional-access policies and session monitoring, and teach employees to question unexpected authentication requests.
- Patch, segment, and validate edge infrastructure. VPNs, firewalls, and gateways require the same urgency and independent testing as endpoints, even when they are harder to monitor.
The central lesson is simple: attackers increasingly succeed by looking legitimate.
They log in with real credentials, use trusted tools, and move through permissions that already exist. Defending against them requires more than identifying obviously malicious software. It requires understanding how identity, access, behavior, and infrastructure fit together—and recognizing when something technically legitimate is being used for the wrong purpose.
The perimeter has not disappeared. But in many attacks, the decisive moment now happens after the attacker has already crossed it.