19/08/2026
A hacker texted an Uber employee on WhatsApp.
Said they were from IT support.
The employee had been bombarded with MFA push notifications for hours โ approve, approve, approve โ until exhaustion set in. They approved.
No malware. No zero-day exploit. No sophisticated breach of Uber's infrastructure.
Just a tired person and a push notification.
That was 2022. The technique has only gotten more refined since.
Here's what this tells us about the state of identity security: Attackers have largely stopped trying to break through walls. Firewalls, IDS, network segmentation. They've moved past all of it. They log in now.
In 2024, over 80% of breaches involved compromised credentials or identity abuse. Your most attacked system isn't your network edge. It's your identity infrastructure and in most organisations, it's still managed as an IT operations function, not a security function.
That gap is costing companies everything.
The modern attack path:
๐ Credentials obtained via phishing or breach databases
๐ Valid login โ no malware, no exploit, nothing to detect
๐ Lateral movement through over-privileged, long-forgotten service accounts
๐ Persistence established by registering new MFA devices or modifying federation trust
๐ Data exfiltrated while traffic looks completely normal
Traditional controls are blind to this. Because the traffic is legitimate.
Three uncomfortable questions for your team:
โ Do you have a single externally-facing app without MFA?
โ Can you account for all your non-human identities: Service accounts, API keys, OAuth tokens?
โ After your last incident, did you run identity forensics or just patch the entry point?
Identity is no longer a supporting function of security. It is the perimeter.
And most organisations are leaving it wide open.
What's the biggest identity security gap you're seeing right now?
Let's talk in the comments ๐
