Post Date: July 6, 2026

Attackers Don’t Need to Hack Anymore

Much of security used to be designed around protecting devices: patch the server, run antivirus and lock down the firewall.

That stuff still matters, but the way we work has changed. Most of your critical systems now sit behind a login, such as Microsoft 365, payroll, banking, CRM and file sharing.

Did you know 80% of cyberattacks start with compromised identity credentials? Whether stolen, phished or guessed, it’s the path of least resistance.

Attackers don’t have to “hack in” like in the movies. They can just sign in using stolen credentials or a stolen session.

Let’s discuss the shift from traditional perimeter defense and what you can do to protect your organization.

Why Identity is the Main Attack Surface

Security used to be simple. Everyone worked in an office, and an enterprise-grade firewall protected everyone inside while keeping everyone else out.

So, what changed?

Cloud migration: Even slightly before the COVID-19 pandemic (but especially after), employees could work from anywhere. You no longer had to be on-premises to access systems and files. Attackers then began targeting logins rather than firewalls.
Credentials are easier to steal: Tricking one employee into handing over their credentials is much easier than bypassing firewalls, intrusion detection systems and antivirus software.
More devices, more vectors: Being able to access work data using smartphones and tablets created more opportunities for attackers. This led to a reliance on identity as the foundation of access.

Before you start implementing mandatory work-from-home rules, thinking this will solve all your problems, there are a few things you can do to protect your business.

How to Protect Your Organization

Before you start implementing mandatory work-from-home rules, thinking this will solve all your problems, there are a few things you can do to protect your business.

Adopt passkeys: Passkeys are the future of security. They are phishing-resistant — meaning they can’t be guessed, stolen or accidentally given away — which makes them much more secure than passwords. Start small with Windows Hello, which replaces your Microsoft 365 username and password with a PIN or biometric. Convert admin accounts first before the rest of the organization. If passkeys aren’t an option right now, at least verify all your accounts have multifactor authentication enabled. It’s not 100% secure, but it will stop most phishing attacks.
Implement identity threat detection and response (ITDR): ITDR detects and responds to suspicious account activity that includes failed login attempts or privilege escalation. Paired with endpoint detection and response (EDR), it’s a comprehensive security tool that monitors the who, when and where behind account usage.
Promote a culture of reporting: Encourage your employees to speak up if something looks off. People avoid saying anything because they don’t want to look stupid or admit they made a mistake. But the sooner your IT team or MSP knows of a possible incident, the more likely they are to contain it and limit the damage. Additionally, implement an easy way to report suspicious emails. One or two clicks should be all it takes to report a questionable email.