Living off the land (LOTL) attacks are a worst-case scenario for enterprises globally, with hackers lurking in networks, extracting sensitive data, and biding their time before wreaking havoc.

These attacks rely on weaponizing the legitimate software and tools used by enterprises, and they're by no means a new trend.

Research from Bitdefender, for example, found 84% of major cyber attacks leverage these techniques, and security teams globally have developed an array of detection capabilities aimed at combatting the threat.

But the dangers posed by these methods could escalate with the arrival of AI agents, according to Zeki Turedi, CrowdStrike's Field CTO for Europe. Speaking to ITPro, Turedi said the deep access given to agents across enterprise IT estates represents a huge threat if even just one were to be compromised or manipulated.

“Organizations are giving them [agents] full access. They're giving them full capabilities. They will have the full privilege of the human user,” he told ITPro.

Turedi pointed to previous LOTL techniques that involved compromising tools like PowerShell. While this gave users access to valuable data, the risk with agents is drastically higher given how they operate, and, crucially, where they can go within networks.

“They also have further reach across an enterprise,” he said. There’s only so much PowerShell can touch or manipulate or modify, but an agent theoretically can touch every single part of that organization's technology ecosystem and architecture.”

“This is where it makes it so much more dangerous.”

Living off the land attacks are evolving

Findings from CrowdStrike’s 2026 Global Threat Report show these risks aren’t just theoretical, they’re now a reality, and the same logic with traditional LOTL attacks is being applied to agents.

Indeed, the cybersecurity firm has observed threat actors exploiting legitimate AI tools at dozens of organizations globally. In these cases, AI systems such as chatbots and assistant were abused to generate malicious commands and steal sensitive data.

The goal here is often focused on credential theft for initial access brokers, attacks later down the line, and even cryptocurrency theft. All typical hallmarks of financially motivated cyber criminals.

LOTL attacks have also become a go-to method for highly sophisticated, state-sponsored threat actors. As ITPro reported last year, the infamous Salt Typhoon threat group laid low in compromised US National Guard networks for nearly a year, accessing sensitive military and law enforcement data.

It’s here where risks are even higher as government departments and public sector organizations begin exploring the use of agents. A recent study from McKinsey, for example, found agentic AI is emerging as a key focus area for public sector organizations in the US.

Keeping up with hype cycles

Turedi told ITPro the focus on agents isn’t surprising given that threat actors will “follow the technology landscape that their victims are looking to invest in”.

“We've seen this time and time again. So previously, we saw as cloud got adopted, funnily enough, adversaries became very capable in cloud,” he noted.

“When organizations started to be more focused and store sensitive data in SaaS applications, SaaS tools, guess what? We saw adversaries go after the SaaS applications.”

Turedi added that the pace of change within the generative and agentic AI space, combined with rapid adoption efforts, could create additional challenges moving forward.

Enterprises across a range of industries are diving headlong into the hype cycle, and threat actors are keen to capitalize on the confusion and lack of risk awareness with the technology.

“This is just a brand new technology landscape that organisations are investing in,” he commented. “And of course, the adversary is very, very aware that for multiple reasons this is a great opportunity.”

“There’s a lot of confusion,” Turedi added. “There’s a lot of lack of knowledge and expertise in this space.”

An identity conundrum

According to Turedi, a key concern surrounding ‘living of the AI land’ attacks, as CrowdStrike dubs them, is that many organizations lack the visibility or governance capabilities to adequately monitor what’s going on with these bots.

This has become a recurring talking point since the advent of agents. Research from Ping Identity in March this year specifically highlighted IT architecture visibility as a key concern for enterprises rolling out agents.

The sheer volume of agents is jarring for security teams, the study noted, but things are exacerbated by sub-agents, essentially creating chains of untraceable bots – an ideal target for stealthy threat actors.

Identity is another area of concern, Turedi noted, albeit one within a broader range of overlapping considerations for security teams. He noted that efforts to improve processes on this front are falling flat.

Many organizations are working with infrastructure or tools that were struggling to manage human identities in the first place. Adding agents into the mix further compounds the problem.

“The problem we see is that a lot of organizations are only starting to think about things like identity security or IAM (identity and access management) hygiene,” he said. “These are typically infrastructures and architectures that were not designed for modern human identity usage, never mind for the AI identity usage.”

With living off the land attacks, the whole advantage for the attacker is that they’re blending into IT environments. They’re using your tools and software and thrive on the confusion. With agents, Turedi said this adds further complexity in terms of identifying what actions are legitimate and potentially nefarious.

“It's actually quite difficult to figure out if it's AI usage on an identity layer,” he said. “Can you truly say that that's a human accessing the network versus that's an AI agent accessing the network on behalf of a human?”

A recent survey from the Cloud Security Alliance (CSA) raised similar concerns with regard to agent identity. More than two-thirds (68%) of respondents said they couldn’t accurately identify agent activity compared to human activity.

Turedi said it’s crucial to have “data from multiple different domains” when it comes to monitoring agent activity, taking into account applications, endpoints, and broader network traffic and “marrying them together” for a clearer picture.

“You need to be looking at the identity layer, you need to be looking at the endpoint, you need to be looking at the application layer,” he said.

FOLLOW US ON SOCIAL MEDIA

Microsoft’s Entra ID platform will now operate solely with passkeys as it looks to shift away from SMS and voice-based authentication practices.

The changes to the identity management platform, set to come into effect on 1 September 2026, will see passkeys established as the “default authentication experience” for users.

Microsoft urged customers to move to passkeys or alternative phishing-resistant methods before the changeover.

“As the rollout reaches each organization, users enabled for SMS or voice authentication will automatically be enabled for passkeys, and the next time they perform multi-factor authentication, they’ll be prompted to register a passkey,” the company explained in a blog post.

There is a grace period, however, with voice and SMS-based authentication still being possible until 1 February 2027. After that deadline, Microsoft will retire telecom delivery for both authentication methods and no longer offer SMS and voice as a “native Microsoft Entra capability.”

For those organizations that still require SMS or voice-based authentication, there is the option to do so via the Microsoft Security Store, where administrators can find approved telecom partners to facilitate this need.

This may incur additional costs, however, with Microsoft warning: "Customers will be responsible for any associated telecom-related costs charged by the telecom partners."

Why is Microsoft moving to passkeys?

According to Microsoft, the shift to passkeys is in response to growing concerns over credential theft, phishing, and social engineering attacks.

AI, the company added, has also prompted a rethink of identity security and a move away from “phishable methods” such as voice and SMS-based authentication.

“Authentication methods that use SMS or voice rely on shared secrets or channels that attackers increasingly intercept, phish, or manipulate,” Microsoft explained.

“The case for moving beyond SMS and voice is no longer just that attackers intercept or socially engineer these methods. The threat environment has changed in speed, scale, and sophistication.”

Microsoft said its Threat Intelligence division has observed a marked rise in AI-enabled phishing campaigns in recent months, with these methods reaching click-through rates as high as 54%.

That’s a stark contrast compared to the 12% click-through rates typically observed in traditional campaigns, highlighting the potency of this new wave of attacks.

Other tactics employed by threat actors, such as SIM swapping and MFA bypass techniques, have also become “more accessible and repeatable”, Microsoft noted.

As ITPro reported earlier this year, AI-generated phishing campaigns have become a recurring concern for cybersecurity leaders.

Research from Kaseya suggested that AI phishing “became the baseline” for threat actors in 2025: 83% of phishing emails used AI in some capacity, while 40% of business email compromise (BEC) attacks also fared similarly.

Why passkeys?

Passkeys are touted as a more reliable and secure method of authentication, as they tie credentials to a specific device, such as a smartphone or laptop. This removes the need for interceptable codes.

Indeed, Microsoft noted that because they use public-key cryptography rather than “shared secrets”, this makes them phishing-resistant by design.

“They also provide a faster, simpler sign-in experience for users,” the company noted.

Microsoft isn’t alone in advising the shift to passkeys. Earlier this year, the UK’s National Cyber Security Centre (NCSC) urged enterprises and consumers alike to adopt passkeys to provide “stronger resilience” and ease-of-use.

“We strongly advise all organizations to implement passkeys wherever possible to enhance security, provide users with faster, frictionless logins and to save significant costs on SMS authentication," NCSC CTO Ollie Whitehouse said at the time.

FOLLOW US ON SOCIAL MEDIA

Barracuda Networks has announced the acquisition of identity and access management (IAM) specialist Evo Security, in a move that will bring expanded capabilities to its BarracudaONE platform.

Founded in 2018, Texas-based Evo Security provides a platform that combines IAM capabilities with privileged access management (PAM) technology into a single, multi-tenant platform tailored to the needs of MSPs.

The acquisition will see the firm’s technology integrated into BarracudaONE, creating a unified offering that brings together access management, identity protection, and identity threat detection and response.

According to Barracuda, the expansion will provide partners with a single platform for delivering identity resilience while helping customers simplify identity security by reducing the need to manage multiple point solutions.

In an announcement, Barracuda CEO Rohit Ghai said combining Evo Security's technology with BarracudaONE will help customers stay ahead of identity-centric attacks as AI continues to reshape the threat landscape.

“In the agentic AI era, protecting both human and non-human identities is imperative for delivering cyber resilience,” he explained. “Existing enterprise identity solutions are complex, costly and fail to meet the needs of MSPs that must scale to securely manage millions of identities across thousands of customer environments.

“We are thrilled to combine Evo Security’s partner-first innovation with our vision of BarracudaONE and offer a complete, intelligent, easy, and open platform that closes this gap.”

According to the vendor, Evo Security’s integration into the BarracudaONE platform will provide partners with a unified identity security architecture that spans privileged access management, access control, identity protection, and identity threat detection and response.

MSPs will be able to manage customer identities from a single multi-tenant environment while enforcing authentication, access policies, identity protection, and identity threat detection.

Barracuda builds on resilience goals

The acquisition also builds on Barracuda’s wider cyber resilience platform, which already includes solutions that cover email security, data protection, network security, cloud security, and managed extended detection and response (MXDR).

For customers, Barracuda said the expanded offering will deliver integrated identity security that is designed to be easier to deploy and manage than traditional enterprise identity platforms, while allowing organizations to retain their existing security infrastructure rather than replacing it.

Alongside the technology integration, Evo Security’s team has joined Barracuda as part of the acquisition and the vendor said it will continue to support Evo’s existing MSP customers as the platform continues to expand.

Commenting on the acquisition, Evo Security founder and CEO Michael Roth said joining Barracuda will enable the business to expand its identity-first approach to a wider global partner base.

“We built Evo Security to solve the identity challenges MSPs face every day,” he explained. “Joining Barracuda gives us the scale, reach and resources to accelerate that mission globally.

“Our identity‑first approach was designed from day one for MSP operations, and now, together with BarracudaONE, we can bring modern identity security, privileged access management and automation to far more partners and the customers they protect.”

Financial terms of the acquisition were not disclosed.

FOLLOW US ON SOCIAL MEDIA

Unmanaged SaaS guest accounts are creating massive security liabilities for small and mid-sized businesses, new research has shown.

According to Kaseya’s 2026 SaaS Security Report, 69% of SaaS accounts have more guest access than licensed users, with persistent third-party access and externally shared data leaving small and mid-sized businesses open to attack.

Gaps in multi-factor authentication (MFA), OAuth sprawl, and external file sharing are widening the SMB attack surface, the study noted. Indeed, threat actors are now abandoning perimeter attacks in favor of softer targets like identities, OAuth integrations, and collaboration workflows.

This, Kaseya noted, leaves a trust gap most small and mid-sized businesses can't even see, let alone close.

“Today’s AI-emboldened threat actors see one interconnected attack environment, whereas most organizations defend their infrastructure in pieces,” said Jim Lippie, chief product officer at Kaseya.

“The most resilient organizations will be those that embrace continuous monitoring, identity governance ,and automated response as foundational requirements.”

AI scramble has caused OAuth chaos

The rush to adopt AI has led to a sprawl of third-party OAuth integrations that use persistent tokens instead of credentials, and that risks granting attackers permanent data access even after password resets.

As a result, non-human service principal logins now account for one-fifth of critical security alerts.

At the same time, attackers are using AI-driven automation to instantly locate and exploit dormant guest accounts, moving faster than manual defenses can respond.

Legacy controls like geolocation blocks are also failing to help, as attackers route traffic through trusted cloud hosts and VPNs.

Outside North America, Kaseya found nearly half (44%) of unauthorized logins originated from trusted infrastructure and outsourced hubs.

India accounts for 14%, the Philippines 10%, Germany 7%, the UK 7% and the Netherlands 6%.

Hackers are exploit SaaS identity gaps

Once inside, attackers are able to exploit massive identity gaps, with 56% of accounts lacking active MFA and only 27% of SMBs enforcing it across the organization.

Meanwhile, researchers found data leakage is through the roof in productivity environments. In Microsoft 365, 45% of all shared files were sent outside the organization.

Companies are also failing to keep up with severe alerts. Last year, while 98.9% of security events monitored by SaaS Alerts were classified as low severity, organizations still faced more than 278 million medium- and critical-severity alerts requiring investigation.

Kaseya recommends transitioning from rigid perimeter defenses to active, identity-first governance frameworks.

"Bridging the modern trust gap requires businesses to move away from static event tracking and instead prioritize automated behavioral monitoring that can flag anomalous activity inside trusted accounts," the company said.

"By aggressively consolidating security stacks, enforcing organization-wide MFA and continuously auditing machine identities and external sharing permissions, SMBs can eliminate critical visibility silos and systematically neutralize attacker persistence before a breach occurs."

FOLLOW US ON SOCIAL MEDIA

Enterprises have experienced a sharp increase in the number of identity-related breaches over the last year, according to two new studies.

According to new research from Sophos, 71% of organizations suffered at least one identity-related breach across 2025, with organizations reporting an average of three separate incidents and 5% reporting six or more.

The main consequences of an identity-related breach are data theft (49%), ransomware (48%), and financial theft (47%), the study found. Indeed, two-thirds of ransomware attacks were carried out this way, with serious financial consequences.

Sophos noted that the mean recovery costs associated with ransomware attacks reached $1.64 million, with a median of $750,000. Nearly three-quarters (73%) of those affected faced costs of $250,000 or more.

“Identity has become the primary attack surface in modern cybersecurity, and this data shows most organizations are losing ground,” said Ross McKerchar, chief information security officer at Sophos.

“The non-human identity problem is particularly urgent. AI agents are being granted privileges faster than security teams can track them, and organizations that fail to get ahead of this will find it an increasingly costly gap to close.”

Enterprises have a visibility problem

Visibility is a critical weakness, according to Sophos, with only a quarter of organizations continually monitoring for unusual login attempts, and more than half checking every three months or less.

Detection, meanwhile, is equally poor. Around 14% of breached organizations were unable to detect and stop their most significant identity attack before damage was done.

A key factor for many identity breach victims lay in compliance, according to the Sophos study. Among those that found compliance requirements challenging, 82.4% had suffered a breach – a full 14 percentage points higher than those with less difficulty with compliance.

UK firms grappling with identity security

In the UK specifically, enterprises are contending with similar challenges. According to Palo Alto Networks' Identity Security Landscape Report 2026, machine identities now outnumber humans 100 to one, creating serious identity security risks.

82% of organizations expect to see the number of machine identities rise over the next 12 months, the study noted, and 90% expect to see a sharp increase in AI identities.

More than one-third (34%) of AI agents and 37% of machine identities have access to their organization’s data, which may include sensitive information such as financial records or high value systems.

Palo Alto Networks noted that only 51% of UK organizations are using behavioral monitoring for their autonomous AI agents.

Identity security has become a key focus – and pain point – for many enterprises since the advent of agentic AI. With agents given deep access to sensitive data sources, risks are amplified and the potential for data leakage is now a leading concern for IT and security leaders alike.

Fragmented tools create blind spots

Fragmented identity security systems and tools are also causing problems with regard to visibility, according to eight-in-ten UK firms. Respondents to Palo Alto Networks’ survey said disparate tools are impacting or delaying their ability to detect and respond to identity-related threats.

As a result, 83% of UK organizations have experienced an identity-related breach, while 74% have fallen victim to at least three in the last 12 months.

“The explosion of machine identities represents a fundamental shift in the enterprise attack surface. With AI-driven identities projected to continue accelerating in the next year, organizations are facing a reality where identity complexity is rapidly outpacing traditional security controls," said Rich Turner, Palo Alto Networks' senior vice president EMEA.

"The fact that 83% of organisations have suffered an identity-related breach in the UK - and 91% in EMEA more broadly - proves that as AI agents gain more access to sensitive data, security leaders must move beyond manual processes. To close the gap, organizations must embrace end-to-end automation and unified governance. Otherwise, the risks of expanding AI and machine identities will only continue to intensify.”

FOLLOW US ON SOCIAL MEDIA

The use of AI agents is spiralling out of control, as they're rushed into deployment more quickly than organizations can govern them.

According to new research from Ping Identity, identity systems originally designed for human interaction are now being pushed to operate continuously.

The firm warned this is placing huge strain on existing models while creating gaps in governance, visibility, and accountability at the point when decisions are executed.

"Enterprises are deploying autonomous AI faster than they can govern it,” warned Andre Durand, CEO and founder of Ping Identity. “Identity remains foundational, but in an agentic environment it must operate continuously. Control must be enforced at the moment an action occurs.”

Researchers noted that agents are creating a new class of identity risk in environments where they operate autonomously across enterprise systems.

By combining individually legitimate permissions in unintended ways, they can generate actions that bypass controls and that can't be fully traced or governed.

Some of the biggest challenges include a lack of visibility when it comes to delegation, along with sub-agent spawning, where agent chains become untraceable and break auditability.

Meanwhile, AI agents are bypassing human decision-makers in ways that aren't planned for in OAuth and OIDC models.

Other issues include context leakage across systems where there's no continuous re-evaluation of authorization, and new questions around permission inheritance, liability, and enforcement in agent-to-agent interactions.

IAM strategies need overhauled

Despite these risks, most identity and access management (IAM) approaches remain centered on human users and static access decisions, leaving organizations unprepared to govern autonomous systems.

“These trends reflect a broader shift in identity requirements,” said Martin Kuppinger, founder of KuppingerCole Analysts, which carried out the research.

“As autonomous agents become more prevalent, organizations will need to extend identity and authorization models to maintain control, accountability, and trust across increasingly dynamic environments.”

According to IBM’s 2025 Cost of a Data Breach report, 13% of organizations have experienced AI-related security breaches, and 97% lack adequate access controls for AI systems.

The Ping Identity report echoes recent research from SANS, which found that non‑human and AI identities are multiplying faster than organizations can secure them.

More than three-quarters of organizations said they were seeing growth in the use of non‑human identities (NHIs) such as service accounts, API keys, automation bots, and workload identities - but that governance was failing to keep pace.

Of the three-quarters already using AI agents that require credentials, 5% of security leaders told the SANS researchers that they didn’t even know whether agentic AI was running in their environment or not.

FOLLOW US ON SOCIAL MEDIA

Non‑human and AI identities are multiplying faster than organizations can secure them, new research warns, and giving AI systems real decision-making power is leaving them wide open to security risks.

More than three-quarters (76%) of organizations surveyed for the 2026 SANS Identity Threats & Defences Survey reported growth in the use of non‑human identities (NHIs) such as service accounts, API keys, automation bots, and workload identities.

The number of identities has quietly doubled or tripled – not because firms have more employees, but because machine‑to‑machine processes now underpin core business operations.

Governance practices have failed to keep pace, however. Indeed, among the three-quarters of organizations that are already using AI agents that require credentials, 5% of security leaders don’t even know if agentic AI is running in their environment or not.

While credential rotation remains a basic defence against long-term compromise, 92% of organizations are failing to carry it out on a 90-day cycle, creating a “forever access” problem.

Meanwhile, 15% admit they don’t even know their machine credential rotation rate, and 59% rotate fewer than half of their NHI credentials quarterly.

The reason for this is often fear that changing machine credentials can break service accounts and lead to downtime, according to SANS.

This, the firm said, encourages teams to prioritize system availability over credential hygiene – leaving high-privilege keys unchanged for months or years.

Structural identity problems are growing

There's also a structural problem, according to SANS. Many organizations still rely on human‑centric processes, such as manual access reviews, ticket‑based provisioning, and periodic rotation.

Crucially, these processes don’t scale to environments with large volumes of continuously authenticating machine identities across cloud, DevOps, and SaaS systems.

While controls such as secrets vaults, automated rotation, and scoped least‑privilege access are increasingly being used, they need to be scaled to match the growth of NHIs.

Agentic AI identities are a big problem

Agentic AI is creating a perilous situation for security teams, SANS warned. Nearly three-quarters (74%) of organizations are deploying AI systems that require credentials and access permissions to operate autonomously, often interacting directly with critical infrastructure and data.

Unlike traditional NHIs, which follow fixed logic, agents interpret instructions and can take unpredictable, non-deterministic actions. This effectively grants them privileged access across environments, with the potential to escalate errors or hallucinate actions.

Despite this though, no single safeguard – approvals, sandboxing, or audit trails – is used by more than 40% of organizations.

“Organizations are giving AI systems real decision‑making power faster than they’re building the governance to control it. We’ve already seen what happens when non‑human identities scale without guardrails, and agentic AI is moving even faster,” said Richard Greene, certified instructor at SANS Institute.

"The early signs of governance are encouraging – nearly four in ten organizations have now use human in-the-loop approvals for AI agent actions – but the real challenge is staying ahead of these systems as they shift from pilots to core operations."

Organizations are at least starting to cotton on to the threat, with recent research from Okta revealing that 85% now view Identity and Access Management (IAM) as important to their security posture, up from 79% last year.

More than three-quarters (78%) of respondents said that controlling access and permissions for NHIs was their main security concern.

According to Cisco's 2026 Data and Privacy Benchmark Study, virtually all organizations are expanding privacy programs and governance frameworks, with AI the main reason for 90%.

FOLLOW US ON SOCIAL MEDIA

Palo Alto Networks has completed its $25 billion acquisition of CyberArk, aiming to fill the gaps in its current offerings by incorporating identity security.

According to Palo Alto Networks, the deal will enable it to secure every identity across the enterprise - human, machine, and agentic - by adding CyberArk's AI-powered Identity Security Platform to its portfolio.

The platform applies intelligent privilege controls to every identity, offering continuous threat prevention, detection and response across the identity lifecycle, with tools covering areas such as privileged access management (PAM), secure single sign-on (SSO), and multi-factor authentication (MFA).

Machine identities now outnumber human identities by more than 80 to one, the company noted, while three-quarters of organizations say their human identities are governed by outdated and overly permissive privilege models.

Attackers are increasingly exploiting identity weaknesses, making credential abuse and excessive privilege among the dominant threat vectors today. Nearly 90% of organizations have already suffered an identity-centric breach, research shows.

However, Palo Alto Networks said companies using identity-driven security controls can speed up their breach response by up to 80% by preventing attackers from abusing credentials and excessive access.

"The emerging wave of AI agents will require us to secure every identity — human, machine, and agent. This is why we moved decisively by announcing our intent to acquire CyberArk last July and am excited to have product integration begin," said Nikesh Arora, chairman and CEO of Palo Alto Networks.

"For our customers, this means the end of 'identity silos.' They can now manage privileged access across their entire hybrid cloud environment from the same company they trust for network security and security operations — to ensure they are secure in the AI era."

CyberArk integration beckons

CyberArk's Identity Security solutions will still be available as a standalone platform, but the two firms are working to integrate CyberArk's capabilities into the Palo Alto Networks security ecosystem.

There'll be no disruption for existing customers, the duo claimed.

"This is a win-win: our customers gain access to the world's most comprehensive security portfolio, and our employees join a global innovation engine," said Matt Cohen, CEO of CyberArk. "Together, we are creating the most robust combination of proven technologies to stop identity-driven breaches."

Under the terms of the agreement, CyberArk shareholders will receive $45.00 in cash and 2.2005 shares of Palo Alto Networks common stock for each CyberArk ordinary share.

Following the deal, Palo Alto Networks plans to pursue a secondary listing on the Tel Aviv Stock Exchange, adopting the "CYBR" ticker. It will continue to be listed on the NASDAQ Global Select Market, trading under the "PANW" ticker.

The closure of the CyberArk deal follows the completion last month of Palo Alto Networks’ $3.35 billion acquisition of Chronosphere, a cloud-native observability provider.

FOLLOW US ON SOCIAL MEDIA

Cybersecurity giant CrowdStrike has signed a definitive agreement to acquire SGNL, a California-based startup specializing in identity security.

The proposed acquisition has been pegged at around $740 million and is expected to close during CrowdStrike’s first quarter of FY2027, subject to customary closing conditions.

The move will see SGNL’s dynamic Continuous Identity privilege and access capabilities integrated into the vendor’s Falcon platform to enable access for human, non-human (NHI), and AI identities to be continuously granted and revoked based on real-time risk.

In an announcement, George Kurtz, CEO and co-founder of CrowdStrike, said the speed and access at which AI agents operate make them a privileged identity that must be protected.

“With SGNL, CrowdStrike will deliver continuous, real-time access control that eliminates the known and unknown gaps from legacy standing privileges,” he explained.

“We’re disrupting the premise of modern privilege and access – for every identity, human or machine. This is identity security built for the AI era.”

Enhanced identity security

CrowdStrike’s Falcon Next-Gen Identity Security offering is designed to secure the full hybrid identity lifecycle, unifying initial access prevention, privileged access management (PAM), identity threat detection and response (ITDR), SaaS identity security, and agentic identity protection.

SGNL operates as the runtime access enforcement layer between modern identity providers and the SaaS and hyperscaler resources. By integrating the technology into Falcon, SGNL will leverage the platform’s real-time intelligence and risk signals to continuously evaluate identity, device, and behaviour to control access as conditions change.

CrowdStrike said the addition of SGNL will eliminate standing privileges for humans, NHIs, and AI agents, as well as enable access enforcement across all major identity systems – extending Falcon Next-Gen Identity Security’s Just In Time access across major cloud identity and SaaS systems such as AWS IAM and Okta.

Continuous access evaluation protocol (CAEP)-driven driven enforcement will also be integrated into Falcon Fusion SOAR, adding the ability to revoke access beyond the identity provider to bolster protection against misconfiguration-driven breaches.

Additionally, SGNL will help unify hybrid identity security across on-premises, SaaS, and cloud environments, the vendor added.

Commenting on the company’s acquisition. SGNL’s CEO and co-founder, Scott Kriz, said the company was founded with the aim of connecting access decisions with ‘business reality’.

“The world needs our technology to eradicate the significant risk that legacy standing privileges expose in today and tomorrow’s environments,” he commented.

“Joining CrowdStrike provides us with global scale natively through cybersecurity’s leading platform to transform enterprise security with Continuous Identity, furthering CrowdStrike’s mission of stopping breaches.”

FOLLOW US ON SOCIAL MEDIA

Platformization is accelerating across the enterprise tech stack. Enterprises are increasingly consolidating around major vendors, attracted by the simplicity of an all-in-one enterprise security offering.

It’s common to find companies operating all-in-one platforms, with security tools bundled into a license that feels easy and predictable to use. Convenience becomes the deciding factor. Even when they don’t cover every requirement, buyers often question why they should look beyond what is included.

For partners, however, this shift carries a clear risk. If everyone sells the same all-in-one stack, differentiation disappears, and channel contribution risks being reduced to transactional resale rather than the strategic guidance that is key to offering real value.

The long-term danger is obvious: partners become interchangeable. And interchangeable partners don’t win high-value projects, trusted advisor status, or long-term customer loyalty.

Why convenience can create hidden risks for customers

The biggest misconception of platformization is the idea that a platform-native deployment automatically means full security coverage. Enterprises often assume that if a capability is included in their license, it must be fit for purpose. However, in practice, many single-vendor platforms often sacrifice depth for scale, leaving critical areas underprotected. Segmentation, defense against lateral movement, and east–west visibility are frequent blind spots.

In our latest research, 90% of security leaders reported experiencing an incident involving lateral movement in the last year, despite high confidence in existing security tools. These gaps are part of why breaches continue to escalate, even in environments with strong firewalls, identity controls, and cloud security tools in place.

Organizations rarely see the problem themselves because visibility inside the network is limited. As a result, they are buoyed by a false sense of security, unaware of any holes in their coverage. The tools give just enough visibility to create confidence, but not enough depth to reveal the full picture. Identifying and filling these gaps is precisely where partners can demonstrate real value.

The partners who win in this era will be the ones who shift the conversation from asking “What’s included in your license?” to “What risk are you trying to reduce?" That change elevates partners from transactional resellers to strategic advisors who identify blind spots, design resilient architectures, and guide customers toward decisions that genuinely reduce risk.

Integration is the new differentiation

As platformization gathers pace, differentiation increasingly depends on a partner’s ability to integrate, not simply resell. Customers may feel that a single vendor provides most of what they need, but a single-vendor platform strategy does not cover every use case or deliver the depth required to address modern threats.

Best-of-breed solutions still matter, especially in areas where all-in-one platforms were never designed to lead. Segmentation, lateral movement detection, and deep east–west visibility often require specialist capabilities that complement the platform rather than compete with it.

Partners who understand how these specialist capabilities interact with platform-native tooling can create architectures that customers cannot assemble alone. They bring together components that work in concert, forming an ecosystem rather than a collection of siloed features. That integration is where real value emerges. It delivers the convenience customers want but enhances it with the depth and precision that such platforms cannot provide on their own.

Building services around platform gaps

To stay relevant as platformization accelerates, partners need to lead with services and outcomes rather than tools. Customers increasingly want guidance on how to address specific challenges like zero trust implementation or ransomware resilience, not just recommendations on what's bundled in their existing licenses.

For example, partners can elevate their offering with assessments that reveal what's actually happening inside the network. Most organizations lack clear sight lines into internal traffic flows, making it impossible to identify risks or measure improvement. An assessment that exposes these blind spots immediately demonstrates the value the platform doesn't deliver.

These findings can be followed up with an expanded service offering to design more resilient architectures that close these gaps. Now, the channel is positioned to help customers understand how specialist tools complement their existing investments, rather than replace them.

This could include, for example, demonstrating how network segmentation works alongside cloud security posture management, or how identity threat detection integrates with their existing identity and access management (IAM) platform.

Building alliances with specialist vendors strengthens this approach and allows partners to offer solutions that complement platform-native capabilities. By combining convenience with depth, partners demonstrate expertise that one platform alone cannot deliver, creating lasting differentiation.

Platformization is not the problem. The real issue is the complacency that comes from assuming built-in security covers every requirement. Customers need the convenience of consolidated platforms, but they also need depth in the areas that platforms overlook.

Partners who deliver both, through expertise, integration, and services, will stand apart.

Cloud security teams are scrambling to keep pace with expanding attack surfaces, new research shows, largely due to the rapid adoption of enterprise AI solutions.

In a survey of more than 2,800 security executives and practitioners by Palo Alto Networks, 99% said they had experienced an attack against AI applications and services in the past year.

Meanwhile, the firm warned generative AI-assisted vibe coding is in use by 99% of respondents - but is generating insecure code faster than security teams can review it.

Of the 52% of teams that ship code weekly, only 18% say they can keep up with fixing the vulnerabilities the technology creates.

“As organizations aggressively scale cloud investments to power AI initiatives, they are inadvertently opening the door to sophisticated new attack vectors," said Elad Koren, vice president of product management at the firm's Cortex security platform.

Notably, Palo Alto warned attacks are getting faster, with breaches that took an average of 44 days in 2021 now taking as little as 25 minutes.

"The speed, scale, and sophistication we’ve observed over the past couple of years is incredible," said Haider Pasha, vice president and chief security officer, EMEA, at Palo Alto Networks.

Attackers are increasingly exploiting the foundational layers of the cloud, targeting API infrastructure, identity, and lateral network movement. API attacks, for example, are up by 41%, making them a primary entry point for sophisticated threats.

The top challenges for cloud security teams

Meanwhile, 53% of respondents cited lenient identity and access management (IAM) practices as a top challenge, saying that insufficient access controls are now a leading vector for credential theft and data exfiltration.

These findings align closely with a recent study from Okta, which also highlighted growing concerns about identity security.

An August survey from the firm found 85% of security leaders now view IAM as a critical security focus, marking an increase on the year prior.

Elsewhere, long-running issues with tool sprawl are adding insult to injury for cloud and security practitioners. Disparate tools are creating dangerous blind spots, the company noted, with respondents now managing an average of 17 cloud tools from an array of vendors.

The resulting fragmented data and context gaps are prompting 97% of respondents to prioritize consolidating their cloud security footprint.

SOC teams are struggling

Security operations center (SOC) staff are also struggling amidst a surge in cloud-related attacks, Palo Alto found. A key factor here lies in disjointed workflows and isolated data sources between cloud and SOC teams, the study noted.

This lack of alignment is stalling remediation efforts, with nearly one-third (30%) of respondents revealing they take more than a full day to resolve an incident.

To cope, researchers said cloud and SOC teams must merge, with 89% of organizations believing cloud and application security must be fully integrated with the SOC to be effective.

"Our research confirms that traditional approaches to cloud security are inadequate, leaving security teams to fight machine-speed threats with fragmented tools and slow, manual fix cycles," said Koren.

"Teams need more than just dashboards highlighting risks they can never burn down; they must transform with an agentic-first platform that spans code to cloud to SOC to finally operate faster than the adversary.”

FOLLOW US ON SOCIAL MEDIA

Docusign is expanding its AI Centre of Excellence in Dublin, saying it wants to accelerate local AI innovation and fuel growth across the EMEA region.

The €4.5 million (£3.9m) investment includes support from Ireland's Foreign Direct Investment Agency (IDA) - a non-commercial, semi-state body promoting foreign direct investment - and was welcomed by minister of enterprise, tourism, and employment, Peter Burke.

“I congratulate Docusign on ten successful years in Ireland and welcome their plans to expand their operations here,” he said.

Docusign said the move will strengthen its European R&D footprint, complementing its French R&D centre in Paris. As part of this expansion, the company said it also aims to increase its engineering team by 20%.

“Today’s announcement underscores our commitment to Ireland and the broader EMEA region,” said Allan Thygesen, CEO of Docusign.

“This significant investment in AI supported by IDA is a testament to the incredible talent pool here and our unwavering focus on building intelligent agreement management solutions for our European customers.

“This is an opportunity to help Ireland realise its vision of boosting competitiveness and enabling a digitally empowered Europe through AI-led innovation.”

Docusign eyes talent boosts

The company said the investment will help it keep pace with regulatory changes, with AI-powered innovation tailored for European regulatory environments, including advanced identity verification, contract analysis, and data privacy tools.

Similarly, the expansion will create new opportunities for Irish tech talent, supporting the country’s reputation as a leading destination for technology innovation through collaboration with the local and regional technology ecosystem.

“Docusign’s decision further establishes Ireland as a trusted European technology partner," said Michael Lohan, CEO of IDA Ireland.

"With a focus on AI that enhances trust, security and compliance, this investment will help drive digital transformation for businesses across Ireland and the wider region.”

Docusign was founded in 2003, with the electronic signature software company now having more than 1,000,000 paying customers and over a billion users worldwide.

Its IAM platform has more than 350 prebuilt integrations with popular business apps, and its API enables embedding and connecting Docusign with customers’ websites, mobile apps, and custom workflows.

However, the investment follows a time of significant change for the company, with rounds of job cuts during 2023 and 2024, and pre-tax losses for the company's Irish arm increasing from €44.65 million to €127.5 million in the 12 months to the end of January 2023.

Revenues, meanwhile, dropped by 5% from €107 million to €102.6 million.

MORE FROM ITPRO

• Proofpoint targets further expansion with Cork investment, new AI innovation center
• Ireland has become a “data dumping ground” for big tech
• UK and Irish businesses "severely underestimating" the cost of IT outages

Microsoft says agentic AI has helped identity and network access teams spot more than 200% more missing baseline policies – so now it's widening the public preview of its Entra Agent ID to keep tabs on agents and other new risks to zero trust strategies.

Microsoft first unveiled a preview of Entra Agent ID in May, and Joy Chik, president of identity and network access at the tech giant, said it quickly became clear that few companies were aware how many agents were active in their environment.

"Before you can securely manage, protect, and govern this new type of identity, you need visibility," Chik said in a blogpost.

"Then you need the right controls, because agent sprawl can quickly lead to excessive permissions, orphaned accounts, and increased risk."

Chik cited a recent Microsoft study that found admins using its Conditional Access Optimization Agent in Microsoft Entra finished key tasks 43% faster and with 48% more accuracy. Alongside that, she reported a 204% improvement in spotting missing baseline policies.

New AI tools for access

Microsoft has now added new tools to its existing Entra solution, which manages identity and network access, to help manage and govern agents, secure access to AI resources for the workforce, and strengthen security via multi-layer access controls.

Chik added that the wider Microsoft Entra Suite is getting new AI powered features.

"First, we’re expanding Microsoft Entra Internet Access to secure access to and usage of generative AI (GenAI) at the network level," she said.

"Our Secure Web Gateway (SWG) is now a Secure Web and AI Gateway. It allows you to secure, govern, and monitor access to any AI or agent from any provider, running on any platform."

What to expect with Entra Agent ID

Entra Agent ID allows companies to use the same tools for workforce identification as it does for AI agents, Chik said. That includes maintaining an inventory of an agent fleet, regulating access to resources and data, and governing them via corporate policies.

"Lifecycle management and IT-defined guardrails, for both agents and the people who create and manage them, keep your agent fleet under control," she added.

The Public Preview of Entra Agent ID also now features AI-powered tools including prompt injection protection, network file filtering, and blocking unsanctioned access to Model Context Protocols (MCP), which allow AI agents access.

Plus, Entra Agent ID now detects shadow AI, helping security teams spot unsanctioned AI tools and letting them monitor usage trends and block risky apps.

"With these controls, you can accelerate GenAI adoption while maintaining compliance and reducing risk, so employees can experiment with new AI tools safely," Chik added.

Beyond those tools, the public preview also includes user-centric access reviews, risk-based approval in entitlement management, threat intelligence and URL filtering, and guest access.

Safer access for AI agents

Microsoft Entra Agent ID can also manage access to Microsoft Agent 365, the dashboard for AI agents unveiled at Microsoft's Ignite conference.

"It takes the same infrastructure that you trust to manage and secure your people and extends it to agents, equipping frontier organizations with leading Microsoft security, productivity, and collaboration solutions," Chik added.

The launch marks the latest in a string of product announcements at the tech giant’s annual conference in San Francisco, which naturally has had a sharp focus on agentic AI.

Microsoft introduced its own MCP Server for enterprise at the event. Entra can be used to manage access, with Agent ID handling authentication and least-privilege access controls.

MORE FROM ITPRO

• Microsoft: get used to working with AI-powered "digital colleagues"
• Microsoft expects 1.3 billion AI agents to be in operation by 2028 – here’s how it plans to get them working together
• Microsoft quietly launched an AI agent that can detect and reverse engineer malware

Closer collaboration between security teams and HR professionals is needed to prevent outgoing workers from leaking sensitive company information, experts have told ITPro.

The warning over staff “offboarding” comes in the wake of several incidents where disgruntled employees have sabotaged their former employer or taken sensitive materials to a new job.

In July, a former Intel engineer who admitted taking trade secrets to a new role at Microsoft received two years’ probation and a fine of over $34,000 by an Oregon court.

Varun Gupta, who had served at the chip maker for over a decade, left in January 2020 but not before copying confidential files containing presentation decks and sensitive business data.

Reports at the time of Gupta’s sentencing show this included PowerPoint presentations outlining the company’s pricing strategies.

Speaking to ITPro, Josh Kirkwood, senior manager for CyberArk’s field technology office, said the incident once again highlights why offboarding has become a perilous process for enterprises.

“It’s all too common for departing employees to walk away with sensitive company information, whether intentionally or simply because access to systems and files isn’t revoked quickly enough,” he said.

“The offboarding process has long been a weak spot for many organizations. It’s clear that a shift is needed. Offboarding should not just be an afterthought,” Kirkwood added.

Damian Garcia, head of GRC consultancy at IT Governance, echoed Kirkwood’s comments, adding that incidents like these have become a recurring theme in recent years – especially amidst continued hybrid working practices.

“Just because someone is out of the building doesn’t mean they’re out of your systems. It doesn’t work like that anymore,” he told ITPro.

“As more businesses move to remote or hybrid setups, people have more ways to stay connected to systems they shouldn’t be anywhere near.”

Garcia warned that layoffs, internal tension, or even individuals feeling undervalued in their roles can “create situations where someone decides to act out”.

“Most employees won’t go down that path, but the small number who do can cause serious damage,” he said.

Unwanted parting gifts

There have been several recent examples of disgruntled employees – whether current or former – have caused havoc for businesses.

In June 2024, a former employee at Singaporean IT firm NCS was sentenced to two years and eight months in jail after he deleted 180 virtual servers following his dismissal.

More recently, a software developer was convicted after installing a “kill switch” in the corporate network of his employer.

According to the US Department of Justice (DOJ), Davis Lu, formerly of power management firm Eaton Corp, conducted a long-running campaign of internal sabotage on the company’s networks, planting malicious code and targeting colleagues.

This incident severely disrupted Eaton Corp’s global IT systems, law enforcement said.

What can be done to prevent disaster?

Garcia told ITPro that enterprises need to act swiftly when employees are in the process of leaving, regardless of the manner of their departure.

“When someone leaves, especially on bad terms, there’s a short window where things can go very wrong,” he said. “That’s when you need to act fast: shut down access immediately, don’t leave it until after the weekend.”

This isn’t just a “box ticking exercise”, either, especially with technical staff such as system administrators or developers who have deep access to internal knowledge bases and critical files. Access rights should be revoked straight away, he added.

“If companies want to reduce the risk, communication between teams is non-negotiable,” Garcia added. “HR, IT, and security need to work together so that access is revoked immediately and consistently.”

Kirkwood added that this is where robust identity management processes are critical for businesses, enabling them to rapidly revoke rights and access.

“The most effective way for enterprises to prevent adverse activity following an employee’s departure is by automating identity lifecycle management,” he said.

“That means ensuring access is automatically provisioned and deprovisioned according to instructions from HR systems.”

Shane Barney, CISO at Keeper Security, noted that tools such as user and entity behaviour analytics (UEBA) can provide an “important additional layer of defence” by establishing baselines of “normal activity and flag anomalies that may signal malicious intent”.

“While UEBA can help organizations detect suspicious behaviour early, it’s most effective when used in tandem with identity-first controls such as zero trust, least-privilege access and privileged access management (PAM),” Barney told ITPro.

MORE FROM ITPRO

• British IT worker jailed for revenge attack on employer that caused a “ripple effect of disruption” for colleagues and customers
• AI means cyber teams are rethinking their approach to insider threats
• Former GCHQ intern risked national security after taking home top secret data

Identity security specialist Okta has announced it has signed a definitive agreement to acquire Israeli privileged access management (PAM) startup, Axiom Security.

The move will expand the Okta Privilege Access platform with Axiom’s PAM capabilities as the vendor looks to help customers further extend their security fabric.

Founded in 2021, Axiom Security provides a cloud-native, identity-centric PAM platform designed to assist organizations in eliminating standing privileges and secure access to critical infrastructure. The solution offers Just-In-Time (JIT) access, automated request and approval workflows, as well as user access reviews.

Terms of the deal were not disclosed but Okta said it expects the transaction to be completed in September, with Axiom’s capabilities to be integrated into its wider PAM offering “over the coming months.”

In an announcement, Okta’s chief technology officer Abhi Sawant said the addition of Axiom will help solve more use cases through additional security controls and connectors to critical infrastructure resources such as databases and Kubernetes.

“Axiom’s technology will be integrated into Okta Privileged Access, expanding access controls to more sensitive resources that Okta customers can use to further strengthen their identity security fabric, so they can manage the types of privileged access across resources and use cases in their environment,” he explained.

Extended identity security

Post-integration, Okta Privileged Access will equip customers with a wider range of capabilities, including unified control through a single point of administration for privileged access across all privileged resources, whether on-premises or in the cloud.

Organizations will also be able to eliminate standing privileges and provide time-limited access thanks to Axiom’s Just-In-TIme (JIT) functionality.

By automating permissions for elevated access to environments such as GitHub, Snowflake, PostgreSQL, and Amazon EKS, Okta said the addition will help reduce operational overhead and risks.

The integration also brings more connectors through AI-based application connector builder capabilities, alongside secure access to Kubernetes and databases for least-privileged access and full traceability.

“As more enterprises bring AI into their workforces, privileged access controls are a key defense layer to properly mitigate AI-related risks,” Sawant added.

“This acquisition will help Okta customers extend their identity security fabric to more privileged accounts and resources, ensuring a single control plane for managing privileged access, whether on-prem or in the cloud.”

MORE FROM ITPRO

• Advania acquires Gompute to bolster AI and HPC capabilities
• Cloud Software Group snaps up data management provider Arctera
• Workday snaps up AI-powered conversation recruitment platform

Organizations are taking 11 person-hours on average to investigate a single identity-related security alert, according to new research.

Analysis from Enterprise Strategy Group found security teams are facing significant challenges managing the volume of alerts, especially since the rise of agentic AI.

In many organizations, meanwhile, its rapid adoption is outpacing organizational oversight and creating new attack vectors.

Identity is already fragmented across cloud services, developer platforms, identity providers, and infrastructure resources such as databases, servers, Kubernetes and workloads.

All told, this fragmented ecosystem of platforms, tools, and solutions, is hampering response times and placing enterprises at huge risk, the report noted.

“When it only takes minutes for threat actors to move laterally across your infrastructure, 11 hours to investigate an identity-related incident simply isn’t good enough,” warned Ev Kontsevoy, CEO of Teleport, a sponsor of the research.

“As we move deeper into the age of AI, we must remember that AI dramatically lowers the cost of identity attacks, and we must expect the frequency of them to increase.

"We must improve the trustworthiness of computing environments. We can only achieve this by eliminating anonymity and human error, and by unifying identity to simplify policy enforcement and enhance visibility of what each identity is doing.”

Credential theft is surging

Things are made all the harder by the ease with which criminals can obtain valid static credentials such as passwords or API keys to impersonate identities.

According to the study, credential theft now accounts for one-in-five data breaches, with the number of compromised credentials having surged 160% in 2025 so far.

This fragmentation of identities is also reflected in the tools that enterprises use to manage them, with security teams using an average of 11 tools to trace identity-related security issues.

The reason is a complex mixture of cloud adoption, cyber insurance requirements and the need for separate tools for different environments, such as on-premises, cloud or SaaS, as well as customer security requirements, legacy tools, and industry compliance requirements.

“Few organizations understand the scale of the threat, let alone how quickly malicious actors can move laterally and disrupt systems," said Todd Thiemann, principal analyst at Enterprise Strategy Group.

"Each application expands a company’s security and compliance surface area, often faster than they can govern it, and few are easily integrated with identity tools."

"This leaves blind spots, orphaned accounts, inconsistent access privileges, and gaps in auditability, which significantly raises the risk of breaches and regulatory penalties," Thiemann added.

Identity security is now a priority

For most organizations, modernizing workforce identity security is a priority, with 91% saying it's a top-five concern.

As a result, budgets are growing year over year, with 87% of organizations reporting plans to increase their spending on workforce identity security, and more than one-third anticipating a significant rise.

According to Kontsevoy, the most efficient strategy lies in combining unified, cryptographic identity with just-in-time access. That’s how teams can more effectively minimize the attack surface.

“The blind spots created by complex IT aren’t just a danger to security. They’re bottlenecking the productivity of engineers and security professionals. They need a way to quickly answer vital questions," he said.

"Who accessed database X and with what permissions? Is this behavior unusual for the identity in question? What’s the full summary of what an identity did in a single session across platforms? To answer these questions, we need a different approach to cybersecurity, one that isn't based on secrets and siloed identities."

Shoring up defenses

The study from Enterprise Strategy Group comes amid a sharpened industry focus on identity security in recent months.

With businesses across a range of industries adopting agentic AI solutions, this poses serious challenges with regard to managing machine identities.

A recent study from Okta, for example, found 85% of security leaders now view identity and access management (IAM) as a crucial part of their broader security posture, marking an increase compared to 79% in the year prior.

Similarly, 78% of respondents to the Okta survey said that controlling access and permissions for “non-human identities” now represents their main security concern, overtaking long-running focuses such as lifecycle management and network visibility.

Okta’s advice on this front centered largely around closer inter-departmental collaboration, urging enterprises to foster closer ties between AI project leaders with security practitioners.

In doing so, enterprises can still accelerate agentic AI projects, but mitigate future potential risks by accommodating security team concerns during the experimentation process.

MORE FROM ITPRO

• How to implement identity and access management effectively
• Enterprises are worried about agentic AI security risks
• Top identity management and security tips for beginners

Organizations are cottoning on to the importance of identity security with the arrival of AI agents, new research shows.

According to a survey from Okta, 85% now view Identity and Access Management (IAM) as important to their security posture, up from 79% last year.

Managing AI agent identity is different from managing human user identities, Okta noted.

They lack accountability, have short, dynamic lifespans requiring rapid provisioning and de-provisioning, and rely on various non-human authentication methods like API tokens and cryptographic certificates.

Similarly, they need very specific and granular permissions for limited periods and can access privileged information, while often lacking traceable ownership and consistent logging, complicating post-breach audits and remediation.

As a result, 78% of survey respondents said that controlling access and permissions for non-human identities (NHIs) was their main NHI-related security concern, with 69% similarly worried about lifecycle management, 57% about poor visibility and 53% about remediating risky NHI accounts.

“I’m most concerned about AI systems having too much access without proper controls,” said one Australian C-level executive in healthcare and pharmaceuticals.

"If not carefully managed, they can expose sensitive data or be exploited for attacks. Strong oversight and access control are essential to keep AI secure.”

However, the study found only 10% of organizations have a well-developed strategy for managing NHIs. Fewer than a third (32%) said they always treat digital labor forces with the same degree of governance as human workforces, and only 36% currently have a centralized governance model for AI.

“We are missing a roadmap and are not aligned on how we as a group should implement AI. Some of the team are working as silos, so we do not yet have a cohesive approach to adopting AI.” said one retail VP in France.

Identity security needs strict guardrails

In terms of governance, Okta recommends involving AI project leaders, including data officers, data scientists, and line-of-business leaders.

Security, including visibility, access controls through the entire lifecycle and the ability to detect and respond to threats should be deeply embedded.

Enterprises are also advised to implement a secure-by-design approach, including user authentication, API access controls, asynchronous workflows, and authorization for Retrieval Augmented Generation (RAG).

"Treat your digital labor forces with the same degree of governance as human workforces,” Okta said.

“Just as contractors, consultants, vendors, partners, and other members of your extended workforce should be subject to the same strict IAM controls as your in-house workforce, so too should the NHIs operating within your IT environment."

The report comes as new research from Silverfort finds the use of NHIs is expected to grow by 29% over the next 12-to-18 months, with 87% of organizations planning to increase their spending on workforce identity security.

Two-thirds (67%) are either very concerned or concerned about the potential for damage relating to NHIs.

"The truth is, AI agents are not machines, nor are they human. They lie somewhere in between and therefore need to be treated as their own category of identity," said the firm.

"An AI agent security solution needs to address these concerns, so every AI agent is tied to a human and has the proper policies in place to prevent (and detect) improper activity."

MORE FROM ITPRO

• How to implement identity and access management (IAM) effectively in your business
• Machine identity attacks will be top of mind for security leaders in 2025
• Palo Alto Networks eyes identity security gains with huge CyberArk acquisition

Okta and Palo Alto Networks have announced an expanded partnership that aims to unify AI-driven security and deliver improved automated threat response.

The agreement sees the introduction of two new integrations, the first of which combines Okta Workforce Identity with Palo Alto Networks’ Prisma Access Browser to create a conditional access method that restricts access to SSO apps to the secure browser.

Identity Threat Protection with Okta AI is also being integrated with Palo Alto’s AI-powered Cortex SecOps platform, extending to Cortex XSIAM and Cortex XDR, to equip organizations with a unified view of identity risks across their entire attack surface.

As AI continues to pose an increasing risk on user credentials, Stephen Lee, Okta’s VP of technology partnerships, said the integrations aim to help organizations incorporate identity into their infrastructure as part of a “fight AI with AI” approach.

"With Palo Alto Networks, Okta is proud to enhance the interoperability of our AI-powered platforms to prevent risks of siloed tools, providing nearly 2000 joint customers with a comprehensive view of their security posture, context-aware access controls, and secure authentication to stay ahead of today’s threats," he explained.

Secure access & threat detection gains

By integrating Okta Workforce Identity with the Prisma Access Browser, enterprises can now implement an additional defense layer for web-based activity.

This, the duo explained, will enable employees to securely access corporate web applications and data through the browser regardless of whether a device is managed or non-managed.

Security teams will gain enhanced visibility and control over SaaS and web application use, while users will benefit from a secure, consistent, and speedy browsing experience.

Additionally, the new integration between Okta and Palo Alto’s Cortex XSIAM and Cortex XDR offerings introduces additional authentication for risky access and user activity.

The combined capabilities tackle threats through automated responses such as revoking user access, ending active sessions, and quarantining of endpoints.

Fresh commitments to security

Okta and Palo Alto Networks said the new integrations reinforce their shared commitment to driving zero trust adoption while ensuring secure and seamless access for hybrid workforces.

Joint customers will benefit from a “clear, integrated path” to confidently secure operations while simultaneously reducing costs and complexity.

"Our deep integrations with Okta ensure that our solutions are engineered to work together, making it easier for our customers to achieve higher levels of security and user experience,” commented Pamela Cyr, Palo Alto Networks’ VP of technical partnerships.

“These new integrations, from securing application access with Prisma Access Browser to providing unified protection against identity threats through our Cortex platform, empower organizations with comprehensive, AI-driven defense."

MORE FROM CHANNELPRO

• MSPs are burned out and overworked as tool sprawl and IT complexity grows
• Brother UK revamps inkjet lineup to drive partner opportunities
• Effective Data and Cleo expand partnership to drive supply chain integration capabilities

Docusign has unveiled the latest evolution of its UK partner program, which has been designed to help partners capture opportunities through its Intelligent Agreement Management (IAM) platform.

Powered by AI, Docusign's IAM platform underpins all of the company's solutions to help organizations create and manage agreements. Since its launch last June, more than 10,000 customers have adopted the platform and have gone on to process "tens of millions of agreements," the firm said.

With its revamped partner initiative, Docusign is aiming to help partners better capture this burgeoning market opportunity through new specializations, tailored tracks, and advanced go-to-market support.

Docusign said the program recognizes the full spectrum of partner types – whether focused on eSignature, contract lifecycle management (CLM), or IAM – and offers support regardless of size and industry of the organizations they serve.

With the new framework, partners can work with the company through the new 'Sell' specialization, which covers IAM Core, IAM for Sales, and IAM for customer experience (CX), or through 'Service and Sell' for CLM.

Additionally, the program's three new tracks offer exclusive benefits designed to help guide partners along clear pathways.

The 'Build track extends the Docusign IAM platform with customer integrations designed to increase customer value, while the 'Sell' track helps drive customer adoption of Docusign's IAM and CLM solutions in a "more strategic, consultive way," the firm said. The third track, 'Service', aids partners in the strategic deployment of the firm's solutions through product expertise.

Additionally, partners can also leverage Docusign University for comprehensive IAM training with new accreditations and certifications.

In an announcement, Docusign said these changes reflect its commitment to positioning partners as trusted advisors, technical experts, and business growth accelerators for customers.

"This is more than a program refresh – it's an evolution that enables partners to play a bigger role in the customer journey," explained Bronwyn Hastings, Docusign's group vice president of partner development and alliances. "Partners are vital to capturing this massive IAM opportunity and we're focused on building a program that supports long-term customer success through partner expertise, trust, and services."

Global cybersecurity spending is expected to surge this year, fueled by escalating state-sponsored threats and the rise of generative AI, according to new analysis from IDC.

Statistics from the consultancy’s Worldwide Security Spending Guide show spending is expected to grow by 12.2% across the year and to hit $377 billion by 2028.

The bulk of this spending - 70% - will be in the US and Europe, the study found. But there's set to be an increase in every geographical region, in particular Latin America, Central and Eastern Europe, and the Middle East and Africa.

Eman Elshewy, senior research manager with IDC Data and Analytics, said rapid digital transformation efforts and enthusiasm for emerging technology adoption have significantly pushed demand for security solutions - and this is expected to accelerate further.

"MEA is witnessing substantial investments from both government and enterprises to fight rising cyber threats, with strong awareness for the importance of cybersecurity education and training programs to fortify organizations against possible attacks."

The industries spending big on cybersecurity

Banking, federal and central government, telecommunications, capital markets, and healthcare providers will be the biggest spenders this year.

Meanwhile, the fastest-growing sectors will be capital markets, media and entertainment and life sciences with an expected year-on-year growth rate of 19.4%, 17.1% and 16.9% respectively.

"The protection from cyber threats — now enhanced by AI and GenAI — is becoming an increasingly strategic issue for organizations in all industries," said Stefano.

He cited in particular organizations managing critical infrastructure - for example, oil and gas or telecommunications - along with those developing critical assets such as aerospace, defense and life sciences, or those providing key services to clients and citizens such as banking or government.

“Although national and international regulations still play an important role in guiding organizations' security strategies — especially in regulated industries — more of them are realizing that having a proactive approach to security is crucial, not only as a short-term operational protection measure but also as a competitive advantage in the long term," he said.

While large and very large businesses account for most security spending across all regions, IDC small and medium-sized businesses will also continue to increase their investments in security throughout the forecast period.

More than half the cash will go on security software, with a 14.4% year-on-year growth rate. There's particular growth for cloud native application protection platform (CNAPP) solutions, for example.

Similarly, smaller enterprises are ramping up investment in identity and access management (IAM) software and security analytics software.

Security services will be the second fastest growing technology group in 2025, driven by the continuing expansion of managed security services, followed by security hardware, which IDC said will achieve single-digit but steady growth in 2025.

MORE FROM ITPRO

• Cyber attacks against UK firms dropped by 10% last year, but experts say don't get complacent
• How to reduce cybersecurity costs for your business
• IT services spending set to surge in 2025 as CIOs shift to AI partner solutions

CyberArk has announced the acquisition of identity governance and administration (IGA) startup Zilla Security for a fee of up to $175 million.

The move will expand CyberArk’s Identity Security Platform with Zilla’s AI-powered IGA capabilities, which are designed to equip organizations with scalable automation of identity compliance and provisioning across digital environments.

CyberArk said the aim is to create a “powerful, comprehensive identity security platform” capable of securing all identities - both human and machine - with the right level of privilege controls.

The agreement will see CyberArk pay $165 million in cash, rising by a further $10 million depending on the achievement of certain milestones, the company said.

In an announcement, CyberArk CEO Matt Cohen described modern IGA capabilities as “critical” for organizations as they navigate the “proliferation of privilege” in complex identity landscapes.

“By expanding the CyberArk Identity Security Platform with Zilla’s modern IGA capabilities, we will reshape identity governance with scalable automation that delivers compliance and helps maximize security for the modern enterprise,” he said.

“We’re delighted to welcome Zilla’s co-founders Deepak Taneja and Nitin Sonawane, along with their talented team, to CyberArk. Their experience and expertise in IGA are unparalleled and will be instrumental in helping us shape the future of modern IGA and identity security.”

CyberArk targets deeper AI integration

Leveraging AI-powered role management, Zilla’s IGA platform automates identity compliance and provisioning processes to drive governance efficiencies and features integrations for both commonly-used and custom applications.

Now available as standalone offerings via CyberArk, the firm said customers will benefit from improved discovery and onboarding of all identities with context and risk mapping, alongside the ability to apply appropriate privilege controls across the board.

Users will also be able to take advantage of automated lifecycle management, policy, governance, and compliance.

Built primarily for on-premises environments, legacy IGA solutions rely on manual processes, which typically result in slower, more time-consuming deployments.

In contrast, modern IGA offerings are purpose-built for the cloud, combining AI-powered business processes with out-of-the-box integrations for visibility across applications.

Zilla said customers experienced in implementing legacy IGA solutions reported that its capabilities can be deployed five times faster, complete access reviews 80% quicker, as well as facilitate a 60% reduction in service tickets.

“What worked 20 years ago clearly doesn’t work today,” explained Deepak Taneja, Zilla Zecurity’s CEO and co-founder. “Zilla represents a fundamental shift in how organizations can manage identity governance and administration.

“By harnessing the power of AI, we’ve automated IGA, making it simpler, faster, and more cost-effective. And now with CyberArk, we’ll be offering our breakthrough technology as part of the broader CyberArk Identity Security Platform, reaching many more customers on a global level.”

MORE FROM CHANNELPRO

• Sharp continues European IT services push with latest acquisition
• IBM eyes Oracle expertise gains with latest acquisition
• Searchlight Cyber snaps up Assetnote in maiden acquisition

Identity and access management firm JumpCloud has revealed its recent ‘security incident’ was an attack by a state-sponsored threat actor, which first accessed internal systems almost two weeks before customers were notified.

Affected customers are also believed to have been specifically targeted by the threat actor which JumpCloud said was “sophisticated… with advanced capabilities”.

The customers that were targeted during the attack have been receiving additional support from JumpCloud to shore up their cyber defenses.

JumpCloud stated that it has mitigated the vector used by the attacker, not revealing any further details related to it, and committed to sharing information related to the incident with industry partners and the US government.

It also released indicators of compromise (IoCs) for the attack, comprising malicious IPs and hashes, and urged firms to use the data for Endpoint Detection and Response (EDR).

“Our strongest line of defense is through information sharing and collaboration. That’s why it was important to us to share the details of this incident and help our partners to secure their own environments against this threat,” said Bob Phan, CISO at JumpCloud. 

“We will continue to enhance our own security measures to protect our customers from future threats and will work closely with our government and industry partners to share information related to this threat.”

JumpCloud’s security incident: What happened?

On 5 July it was found that an attacker had accessed the commands framework for some JumpCloud customers via data injection.

The discovery was made at 03:35 UTC, and at 23:11 UTC JumpCloud rotated all admin API keys. It notified customers that it had invalidated their API keys “out of an abundance of caution relating to an ongoing incident” without providing any further details.

The firm first discovered suspicious activity on an internal system on 27 June, which it linked spear phishing attack on 22 June, but JumpCloud stated that it saw no evidence of customer impact at that stage.

The company responded by rotating credentials, bringing in its incident response partner, contacting law enforcement, and securing infrastructure. It was through the resulting forensic investigation that the activity linked to customers was subsequently found.

"JumpCloud recently experienced a cyber security incident that impacted a small and specific set of our customers,” said a JumpCloud spokesperson at the time.

“Upon detecting the incident, we immediately took action based on our incident response plan to mitigate the threat, secure our network and perimeter, communicate with our customers, and engage law enforcement. 

“As always, our entire JumpCloud team remains vigilant about new and emerging threats, and we are confident in our robust security controls and people. We continue to work with our customers and are committed to sharing information about this incident with government agencies and industry professionals. We appreciate our ongoing partnerships with all our customers."

Although organizations have considered decentralized identification for several years, it’s only recently become a viable solution for managing digital identities in a robust way. 

There’s a spectrum of potential decentralized identification methodologies, ranging from self-sovereign identification – individuals control the information they use to prove who they are – to federated identity – linking an identity to multiple identity management systems. 

At its core, decentralized identification is a potential mitigation strategy against the threat posed by a single central authority having access to personal data. Therefore, as organizations increasingly contend with privacy and security concerns, they’re increasingly exploring a decentralized alternative. 

What are the flaws with centralized identification?

By definition, identification data contain a vast amount of personal information, which could be foundational or functional. Foundational identities are those that have been assigned by a state, such as a birth certificate, passport, or identity card. Functional identity relates to the addition of other attributes, such as relationship status, employment status, and entitlement to various services.

Uncontrolled access to functional identities can be particularly problematic, as it could potentially lead to inclusion or exclusion, or similar abuses. “When the allies left Afghanistan, a large database of Afghani citizens who had helped was unfortunately made available to the incoming government, which is very dangerous for those people,” explains professor Jon Crowcroft, researcher-at-large for the Turing Institute. “It explicitly attributes those people that had helped foreign governments.”

It’s worth noting a distributed system isn’t necessarily decentralized. In a distributed system, data is spread over various servers, but may be within a single, centralized, authority. A decentralized system is where multiple authorities and agencies manage the system collaboratively. Therefore, just because a system is distributed does not make it also decentralized. A classic example of a distributed but centralized system would be the NHS in the UK, where there’s a single body overseeing the different health trusts across the country.

Decentralized identification is a methodology dependent on the organizations involved having a shared approach to identity management and control. “It came out of Tim Berners Lee’s Web3 stuff.” adds Crowcroft. “I'm not a big fan of blockchain and NFTs, but agreeing on standard formats and protocols is really good. It's engineering detail, but it matters, as when people agree to those, then you can have a rapid deployment.”

With a decentralized model for identification, there’s no single agency with oversight – and access to – all of the personal data. There have already been instances where companies have been coerced by governments into handing over user data. “We've seen this in the Snowden paper revelations when the US government would use secret courts to coerce companies that ran cloud services to reveal personal information,” says Crowcroft. 

Having a decentralized model for an identification system means it’s much harder for third parties to access the information. Instead of there being a single agency to be coerced, bribed, or overcome, there are now several. Whilst it won’t prevent third parties from gaining access to the information entirely, it does make it that much harder.

How can you deploy decentralized identities successfully?

With the growing number of privatized government services, decentralized identification is becoming an increasingly viable methodology for preventing a single private organization from having oversight over a large identification system. Decentralized identification allows governments to deploy the identification model across multiple vendors. With the appropriate agreements in place, decentralized identification also allows cross-border information sharing between countries to be conducted in a transparent and controlled manner. 

Although the decentralized identification model is inherently robust, it has a fundamental weakness in that there’s no single authority. For example, there’s no single point of contact for users who have lost or forgotten their passwords. It’s therefore incumbent upon users to have appropriate backups of their security keys, such as a one-time access code. 

In order to be viable, too, there needs to be a stable internet infrastructure so the decentralized identification system can operate between multiple agencies. As such, it has typically been deployed in dense, technologically-educated regions.

In 2021, the Estonian government issued its digital identity card as a decentralized identification system. In this case, it was less concerned about coercive governments abusing data than malicious actors from hostile nation-states accessing it. Although the digital identification system has proven to be highly successful, Estonia is a small country with a population of almost 1.5 million people, approximately the same as the number of people who work for the NHS.

There also need to be redundancy measures in place for when internet connectivity is unreliable, such as in remote regions or when there is poor telecommunication infrastructure. This is akin to carrying a paper copy of an e-ticket for a train or concert in case a smartphone runs out of battery.

“If you were retiring to the Western Highlands, where internet access is patchy, you would still need to be able to prove ID,” says Crowcroft. “If the internet is down that day, you could show up with a credential that you had previously printed in case of an emergency – it’s like I always print my boarding pass because I’m paranoid about my phone breaking. That consideration should be there for things you depend on.”

Given the foundational nature of decentralized identification, it’s best used in projects that are just starting out. Also, given that a decentralized identification would be spread across multiple organizations, these systems are intended for managing large numbers of identities.

When identification management is decentralized, the risk of the data being misused is mitigated due to there no longer being a single point of authority to be attacked, bribed, or coerced. With the agreed formats and protocols established through Web3, decentralized identification could become an increasingly viable method for robustly managing identification systems.

Jobs for life are a thing of the past. Staff turnover has never been higher, in part because it suits employers to structure contracts that way – but more often because there's a skills shortage. Staff are a valuable asset easily lured away by rivals.

And then what? Do you revoke their access, both physical and digital, to keep them away from your infrastructure and data, or should it be business as usual while they work out their notice? A decision like this can only be made if the organisation has a clear picture of what exactly the employee can access.

"You need a complete understanding of the company assets employees use from their first day," said Fredrik Forslund, one of the part founders of the Blancco Technology Group, whose eponymous product is used by businesses to safely wipe used kit for reuse or sale. "You need an asset management system that tracks the physical assets an employee's using, which can be simple to organise and incredibly helpful when reconciling assets following an employee's departure. Besides that, it's great to know all digital services used, which is easiest to achieve with single sign on. Simple tasks like changing passwords and logging out of online services is an important process that could protect your company from a potential data breach."

"An IT admin requires quick visibility into the scope of who has access to what within the organisation, including internal systems, cloud services and files," said Brandon Shopp, VP of product strategy for security, compliance, and tools at SolarWinds, whose access rights manager software helps IT managers understand what a departing staff member had access to, beyond simply their Active Directory account. "Doing this manually is a time-consuming exercise, so having a tool that audits and provides it to you is an important resource. Before the employee exits the organisation, IT admin should revoke access to any information they don't need to complete their final assignments. Having a product in place to help with this not only provides visibility, but also an audit of changes to your infrastructure to help understand who is making changes and what they are."

Why, where and when?

It also depends on the circumstances under which the employee is leaving. Redundancy requires a period of consultation, during which restricting an employee's right to work – and access to resources – may leave an organisation open to legal repercussions. Should an employee voluntarily hand in their notice, however, the situation is somewhat different.

"If the employee is leaving to go to a competitor, it's still the situation in most cases that once they've handed in their notice they'll probably be leaving that day, so won't continue to have access to the [company's] data – although that's a bit of an outdated concept, to be honest," Shaun Thomson, CEO of Sandler Training told us. "By the time someone puts their hand up and says they're leaving, if they want to take that data, they already have it. They'd be silly to wait until the day after they've handed in their notice."

Thomson says organisations should concern themselves with continuation of business at least as much as they think about the safety of their data and the hardware they have loaned an employee. Building multiple contact points for each client, effectively sharing internal data far and wide may, conversely, be the most effective solution.

Hardware and data jurisdiction

"Once the decision about letting someone go has been made, a collection date for assets should be set and when assets are collected, all data should be securely erased with an audit trail... before these assets are transferred to another user," Forslund said. "There should be zero risk for data leaks in between users in a situation like this."

Frequently, the distinction between corporate and personal hardware – and corporate and personal data – is blurred. BYOD can result in business-critical data residing on users' own devices, while personal emails may linger in a corporate inbox. Should employees be allowed to export their mailbox and take their contacts with them?

"Generally, no," said Forslund. "The personal emails must originate from some other service where access to emails should still exist and remain. If employees are allowed to export their inbox, all locally saved work emails will come along, which is not okay."

Shopp agrees. "Company email systems and the underlying data stored within belongs to the company, which makes it the company's discretion to allow the employee to extract any personal items such as contacts and emails before they leave."

It's therefore essential that guidelines for the acceptable use of email are written into staff members' contracts of employment, so that confusion – and conflict – can be avoided at the point of departure.

As Thomson points out, "when you employ people you're looking for certain things, which you're disdainful about when they leave. You expect them to come with contacts but don't want them to leave with any."

But contacts alone are less important than an established relationship once an organisation reaches a certain size.

"When we're working with our client companies, we apply an acid test: do your clients have a relationship with you or just one person in your company?" Thomson asked. "If it's the latter, when that individual moves the client is going to go wherever they go. As you grow – both your own company and a company you're dealing with externally – it's more about dealing organisation to organisation. We use Microsoft Dynamics as a CRM, but if our contact at Microsoft left that wouldn't change: we'd still be using Microsoft software. The bigger a company is, the less likelihood that the employee will be able to take business with them."

From a leadership point of view, then, and with succession planning in mind, only considering the risk to your data at the point an employee announces they're leaving is probably too late. Data can be used as an insurance by staff who feel their position to be under threat. By cultivating multiple touch points between your organisation and its clients, this policy will be less effective, and have a less detrimental effect in-house if it was ever deployed.

You're fired!

Special consideration needs to be given to staff leaving under a cloud, for whom you may wish to curtail access to mission-critical systems and sensitive data in short order.

In this case, SolarWinds' Security Event Manager "alerts you if someone is still trying to use an account once they've been locked out" said Shopp. "It gathers logs that can tell you why someone is trying to authenticate with the account that you've shut down. Is it an application that was installed while the person was still at the company, which you need to go in and shut down, or is somebody actually trying to do something that they shouldn't? Having visibility into that is something that every organisation should have."

As Thomson explained, though, each situation must be considered on its own merits. There's a wide choice of safeguards that companies can choose from, depending on their philosophy, size, and the kind of assets – both physical and data-based – they're dealing with. Key is understanding what staff have access to, and knowing what needs to be done as soon as it becomes clear their time with the business is drawing to a close. After all, the rate of staff turnover is unlikely to slow down any time soon, if ever.

Cybercrime is arguably the biggest threat affecting modern businesses. Half of British companies have experienced a cybersecurity incident over the past year, with large (74%) and medium (70%) firms being the most affected.

That’s according to the 2024 Cyber Security Breaches Survey from the UK Government, which also found that phishing attacks, email and online impersonation, and malware are the biggest cybersecurity threats faced by UK firms.

Two-factor authentication (2FA) adds an extra barrier of entry for any third party attempting to access your account.

Requiring users to complete a second round of authentication after entering a password, whether by entering a code sent via text message or email or by using an authenticator app, adds a far more robust protective layer. While it may seem arduous to jump through these hoops, the benefits of having them in place are untold.

What is the difference between 2FA and MFA?

Two-factor authentication (2FA) is a form of multi-factor authentication (MFA) designed to add an additional layer of security to online accounts, services, and apps. It requires users to prove their identity using two forms of authentication, the first of which is a combination of a username and a password.

Passwords are often stolen by hackers and 2FA aims to solve this by forcing anyone attempting to access an online account or service to confirm their identity via a second form of authentication.

Common examples include one-time passwords, push notifications, biometrics, physical security keys, or codes generated by authentication apps. The premise is that only users will know or have access to this information, preventing unauthorized parties from accessing their accounts using breaches or leaked passwords.

Although 2FA falls under the MFA umbrella, it wouldn’t be accurate to use the former to describe the latter. The main difference between the two is that while 2FA only uses two forms of authentication, MFA relies on two or more methods for verifying user identities.

For instance, a user with MFA set up on their account could be asked to first complete a one-time password request after logging in with their username and password, then an additional form of authentication like a fingerprint. Only after passing these stages would they be able to access their account.

How does two-factor authentication work?

Two-factor authentication invariably uses a second, independent device that functions as a buffer between the service and the login attempt.

Some services will supply their own keys, although this has become less common as companies have turned to developing their own smartphone apps or making use of SMS messages. Regardless of whether it's a number-generating key or a confirmation message, the idea is that only the owner of the device will have access to the key and the ability to authorize the login attempt.

The additional security check normally appears after the user has submitted their username and password. Once the system checks that the account exists, it will then ask the user to perform an additional action.

Two-factor authentication has become ubiquitous with most online services that involve sensitive data, whether it’s banking or financial services, e-commerce, or business applications – although many other companies are starting to offer 2FA to stand out from the competition.

How that additional layer appears can vary from service to service. For example, most banks now have their own security tokens for online banking, often in the form of random number generators and usually offered through a smartphone application, although some users may still be using a physical fob. Many online services have now forced users to set up 2FA as a minimum, including Google and Meta though the latter only has this requirement for 'high risk' accounts.

Getting through a second layer of security can be the slowest part of signing into a service but it's an effective way of sifting out those trying to brute force their way into an account.

What are the benefits of 2FA?

The biggest benefit of 2FA is preventing cyber criminals from breaching online accounts using passwords they've stolen or found in leaked databases on the dark web. But there are other reasons why you should use this security feature.

2FA can help tackle password fatigue, the feelings of tiredness associated with having to constantly remember and enter myriad passwords. It means you can choose an easy-to-remember password with the peace of mind that your account will be secured by a second authentication method.

Security leaders have less cause to worry about account breaches if they have a good 2FA policy in place, in the knowledge that cybercriminals have that extra barrier to entry. Adopting features like 2FA is also key to developing a security-first mindset — paramount as the threat landscape worsens.

Remote workers are still difficult for security teams to support, as their devices and corporate access need to be properly configured with 2FA or MFA, but this step is essential for protecting critical corporate accounts while supporting a hybrid work model. This is particularly critical for offices that take a bring your own device (BYOD) approach, as home devices can be more vulnerable to password-stealing malware and therefore need the extra line of defense.

Using 2FA methods like passkeys and authenticator apps provides users with “better and more secure protection”, says ESET global cybersecurity advisor Jake Moore.

“When threats are multi-layered themselves, accounts need the strongest multi-layered protection to stay secure,” he tells ITPro.

But as well as protecting against password breaches, 2FA could also bring about a passwordless future. Moore says this is possible thanks to “superior security options” that offer greater pxrotection against phishing and brute-force attacks than single passwords. He adds: “Passkeys, for example, offer ease of use, security as well as convenience and are already being rolled out smoothly across multiple accounts.”

Is two-factor authentication safe?

Despite the benefits it offers, it's worth noting that multi-factor authentication is not 100% secure. Microsoft has warned businesses against using systems that rely on voice and SMS due to security concerns, warning that these methods use no encryption and are therefore ripe for interception by hackers. With private details to hand, hackers can launch social engineering campaigns

For example, authentication via text message is vulnerable to interception and spoofing by hackers, particularly if they can hijack an account that supports a person's mobile number. Various account recovery processes for lost passwords can also be harnessed by hackers to work around two-factor authentication.

Sophisticated malware that has infected computers and mobile devices can redirect authentication messages and prompts to a device belonging to a hacker, rather than the legitimate account holder, thereby working within but also around two-factor authentication.

The most secure methods of 2FA use dedicated hardware tokens, such as a Google Titan Security Key or YubiKey, which are difficult for hackers to spoof unless they physically steal one. Google's offering, for example, uses cryptography to verify a user's identity and a separate URL to stop would-be attackers from accessing accounts even if they have the username and password.

Methods of 2FA reliant on codes sent via SMS are best avoided if you are running an enterprise with a treasure trove of data. This is because SMS is vulnerable to SIM swap attacks, in which attackers transfer a victim's number to a SIM card in their possession to intercept their messages. If they pull this off on a user they know uses SMS-based 2FA, they could gain access to their account without any alarms going off.

While 2FA may not be quite the security silver bullet it was once expected to be, it's still an important area of security and access control to keep in mind when procuring and setting up services for your business or personal life, because the more hurdles you can put in the hackers' way, the less likely they are to target you.