One of the most common ways into a company today is the front door, opened with something that looks valid: a password, token, session, or key.
Attackers buy credentials, phish them, pull them from infostealer malware, and wait out multi-factor prompts until someone taps approve. Once inside with a real identity, they look less like an intruder and more like an employee.
The network perimeter still matters, but it is no longer where this fight happens. The fight is over identities: the accounts, sessions, tokens, keys, and permissions attached to them.
The identity attack surface keeps growing
On the human side, the methods have sharpened. Reverse-proxy phishing kits like Evilginx sit in the middle of a real login and capture the session cookie after multi-factor passes, so MFA alone does not stop them.
Infostealer malware scrapes live tokens and cookies straight from the browser. Replayed elsewhere, those tokens hand the attacker an authenticated session with no login event to flag.
On the machine side, non-human identities have piled up: service accounts, API keys, tokens, and AI agents that software uses to reach other software. They now outnumber human accounts in many environments, carry broader access than intended, and stay active long after the original job is done.
Security teams can usually name their employees. Machine identities multiply quietly, often with more access than anyone remembers granting.
Pre-login defense, post-login detection
Identity security now needs two layers. Pre-login controls try to stop an attacker from authenticating at all: phishing-resistant sign-in, better credential hygiene, and cutting the access sprawl that gives a stolen account somewhere to go.
Post-login detection assumes some attempts succeed and looks for abuse after authentication: the impossible travel, the token replay, the privilege escalation, the account suddenly doing things it never does.
The second layer is the harder one to build, and it is where a login that looks legitimate does its damage.
Where identity defense is moving
The 2026 Cybersecurity Stars Awards cover both layers. Start with access sprawl: too many accounts, too many apps, too many permissions nobody cleaned up. Cerby brings identity control to the holdout apps that were never built for single sign-on or MFA. On the infrastructure side, Teleport controls how engineers and machines prove who they are before they reach servers and databases.
Governance covers the rest: Oasis Security checks whether access still matches the task rather than an old rule, Unixi extends that check across apps and trims access when it no longer fits the job, and Saviynt, named one of the year's Most Innovative companies, runs it at enterprise scale.
Not all access is equal. Some accounts are worth more to an attacker: admin accounts, cloud roles, and service accounts that can change systems or reach sensitive data. Those get their own controls.
Britive grants that power only when it is needed and cuts it off when the work is done. Xage Security covers privileged access across IT and the operational technology behind factories and power grids, where a stolen login can reach into the physical world. AutoElevate by CyberFOX brings privileged access management to the managed-service providers that secure thousands of smaller companies.
Access control decides who gets in. Detection has to catch what happens after. Permiso Security won in Identity Threat Detection and Response for spotting identity abuse as it happens: the accounts, roles, and tokens that start behaving outside their normal patterns.
Push Security catches identity attacks in the browser, where users enter credentials, and phishing pages do their work. It also won for AI-powered threat detection.
What to do now
- Move to phishing-resistant authentication. Passkeys and FIDO2 hardware keys resist proxy phishing and prompt-fatigue attacks that defeat SMS codes and push approvals.
- Inventory machine identities. Find the service accounts, API keys, and tokens with broad access, especially those tied to cloud providers, CI/CD pipelines, and AI or agent workflows, and rotate or retire what you do not need.
- Shorten sessions and re-check access mid-session. Long-lived tokens are the prize. Pair shorter sessions with continuous access evaluation that reacts to a change in device, location, or behavior.
- Make privileged access just-in-time. No standing admin rights to critical infrastructure. Grant elevated access for a task, then revoke it automatically when the task is done.
- Watch for abuse after login, not just failed logins. Baseline normal identity behavior and alert on impossible travel, bulk downloads, or a standard account that suddenly starts making admin calls.
The old model treated identity as an admin task: create the account, enforce MFA, move on. That does not hold when an attacker can buy a password, steal a token, or abuse a service account nobody owns. Identity now has to be watched like infrastructure. In many breaches, it is the infrastructure. The way in is a login.
Part of The Stars Briefing, our editorial series on the trends behind the 2026 Cybersecurity Stars Awards, a program The Hacker News runs. This piece analyzes where the field is moving and uses the winners as examples. It is not a product review. The complete list of 2026 winners is live at awards.thehackernews.com/winners/2026.