The biggest risk with knowledge-based authentication (KBA) is that personal history is not a durable secret. Public records, data brokers, social profiles, prior compromises, and information shared across households can expose or narrow the expected answers. Dynamic questions can avoid some weaknesses of fixed security questions, but they still depend…
A successful login can be the last normal event a security stack sees before the damage begins. A password may be correct, and multi-factor authentication (MFA) may succeed from a recognized phone number. From that point forward, however, access depends on sessions, access tokens, refresh tokens, and connected applications. If…
Email risk services can determine whether an email address is valid and estimate how long it has been observed. By themselves, however, they cannot determine whether the person entering the email controls the phone number associated with the account, whether the same address appeared on multiple applications during the past…
Identity security programs tend to protect login more carefully than the paths around it. That leaves identity threat vectors exposed during proofing, account recovery, authenticator enrollment, active sessions, delegated application access, and high-risk transactions. An attacker does not need to defeat the strongest control if another workflow can establish the…
An employee receives a text message warning about unusual activity on a company account. They reply that they don’t recognize it. Minutes later, someone claiming to work in IT calls, references the alert, and guides the employee through an account security process. Was the attack smishing or vishing? It was…
A customer logs into their account from a familiar device using the correct password and successfully completes multi-factor authentication (MFA). Minutes later, they change the account recovery phone number, add a new payout destination, and transfer funds. Did the customer authenticate successfully? Yes. Did the organization make the right access…
SIM swaps can redirect one-time passwords (OTP) to another device, while number porting can move a phone number to another carrier. In both cases, the identity assumptions behind using a phone as an authentication factor are undermined. The National Institute of Standards and Technology (NIST) classifies authentication over the Public…
The contractor you just onboarded to work inside your environment could be a fraudster operating under a stolen identity, even though the vendor they claim to represent is a legitimate, registered company. Registration simply proves that a business entity filed paperwork with a state. It says nothing about who controls…
When an agentic AI agent acts on a user’s behalf, most current deployments run it with that user’s privileges and record its activity under the user’s identity. The agentic AI agent itself disappears into the session. That design choice creates the core challenge of governing agentic AI. Two distinct principals,…
Identity weaknesses played a material role in almost 90% of the 750-plus incidents Palo Alto Networks’ Unit 42 investigated in 2025, with 65% of initial access driven by identity-based attacks. This was not solely because those organizations lacked multi-factor authentication (MFA) or security training. Rather, attackers…
