Inside the Modern SOC: The Identity Front Door
Summary: Unit 42's 2026 Global Incident Response Report found identity weaknesses played a role in nearly 90% of incidents it investigated, with 65% of initial access activity involving identity-based techniques such as credential theft, MFA manipulation, session hijacking and social engineering. The report also found 87% of incidents span multiple attack surfaces, and Unit 42 cites threat groups like Muddled Libra (aka Scattered Spider) as an example of attackers relying on social engineering and identity abuse.
Key Takeaway: If identity weakness is a factor in nearly 90% of the incidents Unit 42 investigated, then a successful login is no longer a reliable signal of legitimate activity - and the 87% of incidents crossing multiple attack surfaces means the evidence is scattered across tools your analysts have to pivot between.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026