As it does every year, the Cybersecurity and Infrastructure Security Agency (CISA) issued its Cybersecurity Awareness Month recommendations a few weeks ago. The recommendations provide a useful baseline for reducing everyday cyber risk. Unfortunately, they are insufficient for defending against the modern identity-based attacks that large…
The Federal Bureau of Investigation’s (FBI’s) Internet Crime Complaint Center (IC3) recorded $359.7 million in reported account takeover (ATO) losses in the last year. An enterprise can deploy phishing-resistant multi-factor authentication (MFA) and still lose an account if its help desk accepts a convincing explanation for…
Identity data hygiene entails keeping identity records current, correctly linked, and fit for the decisions they support. Data cleansing, such as standardizing names or address formats, is the most commonly addressed data hygiene issue, but it is only part of a complete strategy. Security-grade identity data hygiene must also establish…
Enterprise identity environments are built to manage access for human identities. With the growing adoption of autonomous AI agents, however, that may no longer be enough to ensure digital security. In current environments, even if an enterprise can trace which account an action originated from, there may still be ambiguity…
When identity verification checks only confirm narrow facts, synthetic identity fraud can still succeed. Consider several risk signals commonly used in identity workflows today. An active phone number shows that a line is in service. A returned one-time passcode shows control of that number during an interaction. Document validation indicates…
Phishing-resistant authenticators offer stronger security, but they can still protect the wrong person. When a threat actor defeats identity verification during onboarding, an otherwise strong access management workflow can still grant unauthorized access. If a threat actor bypasses authentication by exploiting account recovery, the system may bind a replacement factor…
Account recovery workflows decide which person and which device an organization will re-trust. That makes recovery a privileged identity lifecycle event. For the most part, account recovery processes are designed to restore access conveniently. That emphasis on convenience can allow attackers to bypass the controls meant to keep them out.
An employee receives a text message warning about unusual activity on a company account. They reply that they don’t recognize it. Minutes later, someone claiming to work in IT calls, references the alert, and guides the employee through an account security process. Was the attack smishing or vishing? It was…
The contractor you just onboarded to work inside your environment could be a fraudster operating under a stolen identity, even though the vendor they claim to represent is a legitimate, registered company. Registration simply proves that a business entity filed paperwork with a state. It says nothing about who controls…
When a rewards balance disappears, the loss becomes visible at redemption. Miles may be transferred to a partner program, points converted into gift cards, or award travel booked without the account owner’s knowledge. By the time that happens, however, the loyalty program fraud has already succeeded. The real questions arise…
