Key takeaways
Identity-based attacks exploit authentication, not software. Attackers use stolen, guessed, or forged credentials to enter through legitimate login channels. The systems work as designed; the identity is compromised.
Seven attack types account for most identity compromises. Phishing, credential stuffing, password spraying, pass-the-hash, golden ticket, silver ticket, and man-in-the-middle attacks each exploit a different part of the identity chain.
These attacks are often chained together. An attacker may phish credentials for initial access, use pass-the-hash for lateral movement, and forge a golden ticket for persistence. Defending against one type is not enough.
Defense requires multiple layers. Phishing-resistant MFA, zero trust verification, continuous monitoring, least privilege, and user education work together. No single control is sufficient.
Why are identity attacks on the rise?
Five factors have converged to make identity the primary attack surface for most organizations. In fact, credential abuse was the leading initial access vector, involved in 22% of breaches (Verizon DBIR, 2025).
Cloud migration and Software as a Service (SaaS) adoption have moved applications and data outside traditional network perimeters. Each new cloud service creates another set of credentials to protect and another authentication endpoint to defend. The attack surface expands with every SaaS application an organization adopts.
Remote and hybrid work eliminated the assumption that users inside the network are trustworthy. When employees authenticate from home networks, hotel Wi-Fi, and personal devices, the network boundary disappears and identity becomes the only reliable security perimeter.
Non-human identity proliferation, which includes service accounts, API keys, automation pipelines, and machine-to-machine credentials, challenge governance structures. These now outnumber human identities in most enterprise environments, and they frequently hold elevated privileges with passwords that are rarely rotated and never subject to MFA.
Credential theft at scale has become industrialized. Infostealer malware harvests saved passwords from browsers and applications automatically. The 2025 Verizon DBIR found that 30% of systems appearing in infostealer logs were enterprise-licensed devices, and 46% of those had corporate logins stored alongside personal credentials.
Dark web marketplaces also sell stolen credentials in bulk, making the initial access step trivial for attackers.
Password reuse amplifies the damage from every breach. A single compromised credential can unlock access to multiple systems.
What are the most common identity attack vectors?
Seven attack types, or vectors, account for the majority of identity compromises. These are methods attackers use to compromise credentials and authentication systems, and they frequently chain multiple techniques in a single campaign.
Phishing and social engineering
Phishing uses fraudulent communications, typically emails, messages, or fake login pages, to trick users into revealing credentials. Social engineering is the broader practice of psychological manipulation to deceive users into taking actions that compromise security.
Phishing exploits human psychology rather than technical vulnerabilities, which is why it remains the most common initial access vector. Modern variants include AI-generated phishing emails, deepfake voice impersonation, and spear phishing, which gathers available personal information from sources like social media for targeted attacks.
Credential stuffing
Credential stuffing uses automated tools to inject stolen username-password pairs from previous breaches into login forms across multiple services. Attackers obtain credentials from data breaches, then use bots to test those combinations against other sites, gaining access wherever users reused passwords.
The attacks are effective because they exploit password reuse at scale. Sophisticated attackers attempt combinations only once, so the attempts blend into normal login traffic without triggering rate limits.
Password spraying
Password spraying uses a few commonly used passwords (like "Password123" or "Summer2024") across many user accounts. Unlike brute force attacks, that try many passwords against one account and trigger lockouts, password spraying tries one password against many accounts, waits, then tries another. This keeps attempts below account lockout thresholds while exploiting weak password policies and default credentials.
Pass-the-hash attacks
Pass-the-hash attackers use captured password hashes (one-way cryptographic representations of passwords) to authenticate to systems without ever knowing the plaintext password.
The attacker compromises one Windows system, extracts NTLM password hashes from memory, and uses those hashes to authenticate other systems on the network. This enables lateral movement across Windows environments even when the actual passwords are long and complex, because the hash alone is sufficient to authenticate. MITRE ATT&CK classifies this as technique T1550.002.
Golden ticket attacks
A golden ticket attack targets Kerberos, the authentication protocol used in Windows Active Directory environments. The attacker compromises a domain controller and extracts the password hash of the KRBTGT account, the service account that signs every Ticket Granting Ticket (TGT) in the domain. With that hash, the attacker can forge TGTs for any user with any privileges, effectively owning the entire domain.
Golden tickets can remain valid for years and persist even after individual user password resets, because the forged ticket is signed with the KRBTGT hash, not the user's credentials.
Silver ticket attacks
A silver ticket attack forges Kerberos service tickets for a specific service rather than granting domain-wide access. The attacker compromises a service account's password hash and uses it to create fake service tickets. The target service accepts these tickets as genuine.
Silver tickets bypass the Key Distribution Center (KDC) entirely, so no authentication request appears in the KDC's logs, making them harder to detect than golden tickets. The scope is limited to the compromised service, but that service may hold sensitive data or critical functionality.
Man-in-the-middle attacks
Man-in-the-middle (MITM) attacks intercept communications between a user and an authentication server to capture or alter credentials in transit. Common scenarios include rogue Wi-Fi access points that capture login credentials from users who connect, and adversary-in-the-middle phishing proxies that relay authentication in real time. These can capture both passwords and MFA codes as the user enters them. MITM attacks are particularly effective on public networks where users cannot easily verify the legitimacy of their connection.
Attack vector | Primary target | Common environment |
|---|---|---|
Phishing | User credentials via deception | All environments |
Credential stuffing | Reused passwords | Web applications |
Password spraying | Weak or default passwords | All environments |
Pass-the-hash | Windows password hashes | Windows networks |
Golden ticket | Domain-wide Kerberos access | Active Directory |
Silver ticket | Service-specific Kerberos access | Active Directory |
Man-in-the-middle | Credentials in transit | Public/untrusted networks |
What are the essential defenses against identity-based attacks?
Defending against identity attacks requires layers of security. The five defenses below work together to create a comprehensive identity security posture.
Enforce phishing-resistant multi-factor authentication
MFA requires two or more verification factors from different categories:
Something the user knows
Passwords
Personal questions like "first pet" or secure financial details
Something the user has
Security key
Phone
Something the user is
Fingerprint scan
Face scan
Iris scan
Voice recognition
Phishing-resistant methods like FIDO2 security keys and passkeys are critical because they cannot be intercepted by adversary-in-the-middle proxies or defeated by MFA fatigue attacks, where attackers bombard users with push notifications until one is approved.
SMS codes and email-based MFA can be intercepted through SIM swapping or phishing, making them less secure. Enforce MFA for all users, with the strongest methods required for privileged accounts and access to sensitive systems.
Adopt zero trust verification
Zero trust assumes no user or device is trustworthy by default, regardless of network location. Every access request requires verification of identity and device health. This limits the damage from compromised credentials because stolen passwords alone are not sufficient when the system also verifies device posture, location, and behavioral context. Zero trust prevents attackers from moving freely through the network even with valid credentials, which directly counters pass-the-hash and golden ticket attacks that rely on lateral movement after initial compromise.
Implement continuous monitoring and analytics
Continuous monitoring tracks authentication activity and user behavior in real time. Once it establishes a baseline of legitimate behaviors, it can detect anomalies that may indicate compromised identities.
Key signals include login attempts at unusual times or from unusual locations, access to resources outside normal patterns, impossible travel scenarios, privilege escalation attempts, and service authentications that appear in service logs but not in KDC logs (a potential indicator of silver ticket forgery).
Machine learning models can establish per-user baselines and flag deviations. Identity Threat Detection and Response (ITDR) platforms specialize in monitoring identity infrastructure like Active Directory for attack techniques including golden ticket and Kerberoasting attempts.
Secure privileged accounts with least privilege access
Privileged accounts (administrators, service accounts) are frequently targeted by attackers because they hold elevated access. The principle of least privilege (PoLP) grants each user and service account only the minimum permissions their function requires.
Just-in-time access provides temporary elevated permissions that expire automatically. Separate privileged accounts from daily-use accounts so that a compromised email account does not also grant administrative access. Regular access reviews catch permission creep, and Privileged Access Management (PAM) platforms provide secure vaulting, session recording, and automated credential rotation for the most sensitive accounts.
Educate and train users
Users are both the most targeted attack vector and the first line of defense. Training should cover recognizing phishing attempts, creating strong, unique passwords, reporting suspected incidents, and understanding social engineering tactics. Revisit topics often and try to make sessions or materials role-specific. The obligations of someone handling customer data differ from those of a developer or executive.
How should organizations implement strong IAM and monitoring?
The defenses above address specific attack types. Governance and monitoring ensure those defenses remain effective over time as the organization, its identity landscape, and the threat environment evolve.
Streamline policies and access reviews
Conduct periodic access audits to identify common identity risks:
Orphaned accounts for departed employees
Permission creep, where users have accumulated unnecessary access
Dormant accounts that should be disabled
Shadow admins, non-administrative accounts with admin-level privileges
Automate provisioning and deprovisioning by integrating identity management with HR systems so that access is granted when employees join and revoked when they leave. Consider role-based access control (RBAC), which assigns permissions based on job function rather than individual identity, simplifying management and ensuring consistency.
Monitor non-human identities
Create a comprehensive inventory of all non-human identities across cloud and on-premises environments. Implement automated credential rotation (every 30 to 90 days depending on privilege level).
Apply the same behavioral monitoring to non-human identities as to human accounts to detect misuse. Use dedicated secrets management tools for secure storage and access control of credentials and API keys rather than hardcoding them in applications.
Integrate threat intelligence
External threat intelligence provides context about current attack campaigns, compromised credential databases, and malicious IP addresses. Monitor leaked credential feeds to proactively reset passwords for affected users before attackers exploit them.
Integrate threat intelligence with authentication systems to automatically increase verification requirements or block access from known malicious sources. Participate in industry information sharing groups to learn about threats targeting similar organizations.
How can identity security platforms protect against identity-based attacks?
Identity-based attacks exploit different parts of the identity chain, and defending against them requires capabilities that address the full spectrum.
Phishing-resistant MFA blocks credential theft at the point of entry. FIDO2 security keys and passkeys cannot be phished, replayed, or defeated by MFA fatigue attacks, directly countering the most common initial access vector.
Device trust verifies that devices meet security standards before granting access. An attacker with stolen credentials on an unmanaged or compromised device is blocked before authentication completes, adding a layer that credential theft alone cannot bypass.
Risk-based authentication evaluates contextual signals (device, location, behavior, timing) to detect anomalous access attempts. Even when credentials are valid, deviations from established patterns trigger step-up authentication or block access, catching attacks that static authentication misses.
SSO with centralized policy enforcement ensures that identity security policies apply consistently across every connected application. This eliminates the gaps that arise when individual applications manage authentication independently.
Continuous monitoring and identity intelligence provide real-time visibility into authentication events, anomalous behavior, and permission drift. These signals enable security teams to detect identity compromises in minutes rather than the weeks or months that traditional approaches require.
See for yourself how Duo's IAM platform with phishing-resistant MFA, device trust, SSO, and more, can strengthen your organization against identity-based attacks. Try Duo for free.