Context and Chronology

Field Effect, a global managed detection and response provider, reports that more than 80% of the incident-related alerts it investigated in 2025 followed cloud identity compromise. Their casework shows adversaries increasingly entering through legitimate accounts and blending with routine activity, which complicates detection and gives attackers noisy-free paths to privilege escalation. Attackers used tenant impersonation, voice-based vishing inside collaboration platforms, and abused remote‑support workflows to deliver PowerShell tooling and harvest credentials for lateral movement and persistence.

The vendor links a practical acceleration in attacker operations to widespread use of generative-model tooling: phishing and persona creation scaled, automated reconnaissance validated targets faster, and conversion times from contact to credential validation materially shortened. Rather than novel exploitation techniques, attackers are automating established social‑engineering playbooks to increase throughput and reduce operational friction for mid‑tier criminal groups.

Edge infrastructure and exposed management interfaces remained consequential vectors in Field Effect’s caseload: campaigns targeting VPNs, routers and SSL appliances repeatedly relied on credential reuse and late-applied patches to gain high‑privilege access. Specific casework cited authentication into SonicWall SSL VPNs with recycled secrets that were subsequently used to stage ransomware operations including activity linked to Akira.

Industry telemetry from peers provides a corroborating but broader view. CyberArk field data point to roughly 82 machine identities per human, with about 42% of those holding privileged access — underscoring how service accounts, API keys and tokens expand the adversary’s target set. IBM X‑Force observed a 44% year‑over‑year rise in attacks against public‑facing applications driven by automated discovery and credential validation, while CrowdStrike reported a large uptick in model‑assisted attacks and a median breakout interval measured in minutes (their field figures note an average near 29 minutes for high‑velocity incidents).

These cross‑industry signals help reconcile differences in percentages: Field Effect’s >80% figure reflects identity‑linked alerts within its MDR caseload and the contexts it triaged, whereas vendor‑wide studies aggregate across different telemetry domains and vertical mixes. Together they show a coherent operational pivot — identity and machine credentials are now primary enablers of access and escalation, while automation compresses the window defenders have to detect and contain intrusions.

Operational gaps compound risk. Multiple vendor surveys and field studies show playbooks routinely omit comprehensive handling of non‑human credentials during containment: teams reset human passwords but often fail to rotate service accounts, API keys and certificates, leaving trust chains intact and lengthening attacker dwell time. Discovery and governance remain immature in many organizations, producing invisible service accounts that attackers can reuse to sustain access.

For defenders the prescription is consistent across reports: elevate identity and access controls (hardware‑backed MFA where feasible, conditional access and attestation for agentic tools), adopt behaviour‑based detection that fuses endpoint, identity, cloud and browser signals, and make non‑human credential inventory, rotation and cross‑system revocation standard steps in containment playbooks. Field Effect’s Director of Security Services, Earl Fischl, emphasized that treating identity as an authentication checkbox is insufficient; organisations must instrument identity as an active control and shorten remediation windows.

Practically, this means pre‑incident machine‑identity inventories, automated rotation and revocation during incidents, tighter remote‑support workflows, and faster patching or compensating segmentation for appliance management planes. Industry examples — rapid weaponization of disclosed appliance bugs and automated campaigns that validated thousands of management interfaces — illustrate why these changes must be operationalized now.

Finally, the combined reporting highlights a broader economic shift: valid, curated access and session artifacts are becoming higher‑value assets for adversaries than ephemeral zero‑days because they are cheaper, more reliable and harder to detect. The net effect for 2026 will be less about new cyber‑primitives and more about faster, cheaper, and more convincing exploitation of existing weaknesses — pushing defenders toward telemetry fusion, identity‑first architectures and deterministic recovery planning.