For years, organizations treated network security as a matter of keeping attackers outside the perimeter. Cloud services, hybrid work and SaaS adoption have changed that model. Employees now authenticate from many locations and devices to reach email, collaboration tools, business applications and cloud infrastructure, making identity the practical gateway to critical systems.
That gateway is under sustained pressure. Verizon’s 2025 Data Breach Investigations Report found that credential abuse remained the most common initial access vector in breaches, while 30% of systems represented in infostealer logs were enterprise-licensed devices. The introduction of MFA has reduced the value of a simple stolen password, but it has not removed identity as an attack route.
“Identity became the front door of the business,” Dray Agha, Senior Manager of Security Operations at Huntress, says. “But we all just slapped MFA in front of it and we went home.”
Attackers are adapting, and to keep up, enterprises need to understand how identity is now being leveraged to gain access to their systems.
Why MFA Alone Is No Longer Enough
The problem is not that MFA has ceased to be valuable. It blocks a substantial volume of account takeover attempts. However, as MFA has become more widely adopted, attackers have looked for other ways to compromise identity, with authenticated sessions becoming the new battleground.
Unlike a password, which can be reset quickly, a session cookie, access token or refresh token may give an attacker continuing access. By stealing or inducing the creation of that token, an attacker may gain access as the user without knowing the password or completing MFA themselves.
Agha notes that, in some scenarios, this can create long-lived persistence: “If I steal the session token, that’s powerful.” It can also allow criminals to register their own MFA devices, making recovery more complicated than a routine password reset.
Attackers are acquiring those tokens through increasingly familiar-looking interactions. Adversary-in-the-middle phishing proxies can relay a victim’s legitimate sign-in to Microsoft or another identity provider, capturing the resulting session rather than merely harvesting credentials. Infostealer malware can extract browser cookies and saved session data. Device-code phishing is particularly problematic because it abuses a legitimate authentication flow: the victim is convinced to enter a code on a real sign-in page, then unknowingly grants the attacker tokens.
Microsoft documented this pattern in its analysis of the Storm-2372 device-code phishing campaign. It found that actors used captured tokens to access email and cloud services, search mailboxes through Microsoft Graph and, in some cases, register attacker-controlled devices. This is why training people merely to spot spelling mistakes or suspicious domains is no longer sufficient to stop them from giving away access. The malicious interaction can be technically legitimate, while the social engineering is not.
Because these attacks gain legitimate access, the havoc they can wreak can be devastating. Agha describes a client experience in which he saw an attacker attempt to alter a company’s banking details to intercept a £2 million transaction.
What Can Businesses Do About It?
For Agha, the first response is to move beyond a binary view of MFA. “MFA doesn’t fall short because it’s bad. It’s just not enough anymore,” he says. For businesses, that means retaining it while reviewing which authentication methods are allowed, which applications and users need them, and what happens after a successful sign-in.
Conditional access is the second essential layer. Risk-based policies can restrict access from unmanaged devices, unusual locations or high-risk sessions, while device-code flow should be blocked where it is unnecessary. Microsoft specifically recommends restricting device-code authentication through Conditional Access, enforcing re-authentication where appropriate and limiting who can enroll devices. This is the kind of defense in depth Agha says more mature organizations are already adopting, rather than treating MFA as the final security boundary.
Identity telemetry must also be monitored as seriously as endpoint activity. Security teams should be alert to new MFA registrations, unexpected device enrollment, unusual OAuth consent, suspicious mailbox rules and anomalous token use. Least privilege matters too: a compromised account should not automatically create a route to sensitive finance systems, cloud administration or broad data access. The goal is to reduce the blast radius before a successful deception becomes a serious breach.
When attacks have penetrated defenses, fast containment is equally important. Agha argues that cloud identity creates an opportunity for “minimum viable disruption”. Revoking sessions, disabling a suspect account and forcing re-authentication may inconvenience an individual briefly, but it is far less damaging than allowing an intruder to remain inside an executive or finance mailbox. Incident plans should explicitly cover token revocation, device removal, MFA method review and communications with finance teams, not just password resets.
Why You Must Move Now
AI will intensify the pressure, not because every attack now requires sophisticated AI tooling, but because it lowers the cost of convincing impersonation. Agha expects more targeted social engineering, deepfakes and carefully copied company branding as a result.
That makes compliance-led security insufficient. As Agha puts it, organizations that do only “the bare minimum tend to be compromised by the bare minimum attacks.” Identity protection must become an operational discipline spanning authentication design, access policy, behavioral detection, user culture and incident response.
The organizations best placed to withstand this shift will be those that stop measuring success by whether MFA is deployed and start asking whether a stolen session can be detected, constrained and revoked quickly. In the identity-first era, the question is no longer whether the front door has a lock; it is whether the business can recognize when someone has entered with a stolen key.
