Across our 180-customer fleet in 2025, identity-based attacks overtook endpoint malware as the most common initial vector — by a 3-to-1 margin.
The top 5 techniques: (1) MFA fatigue / push bombing, (2) Adversary-in-the-middle phishing kits, (3) OAuth consent abuse, (4) Service-account credential theft, (5) SSO session hijacking via stolen device tokens.
Defensive priorities for 2026: phishing-resistant MFA (FIDO2 / passkeys), conditional access on every authentication flow, SaaS-to-SaaS OAuth governance, and detection rules that fire on anomalous OAuth grants — not just failed logins.
Endpoint EDR remains essential, but if you're investing on the margin, identity is where the next $1 of budget yields the highest detection lift.