- Most breaches involve a stolen or abused account, so identity is where attackers aim first.
- Multi-factor authentication, ideally with passkeys or hardware keys, closes the most common door.
- Least privilege and regular access reviews limit the damage when something goes wrong.
Why identity matters most
When systems moved to the cloud and people began working from anywhere, the office network stopped being the boundary. Now the boundary is who you are and what you are allowed to do. An attacker with a valid account often does not need to break anything. They simply sign in.
Multi-factor authentication done well
- Use it everywhere it is offered, beginning with email, remote access, cloud consoles and administrators.
- Prefer stronger methods. Authenticator apps are better than text messages. Passkeys and hardware security keys are better still because they resist fake login pages.
- Guard against prompt fatigue. Teach staff to deny and report approval requests they did not start, and use number-matching where available.
- Protect recovery. Attackers target password reset and help desk processes, so verify identity carefully there.
What passkeys are
A passkey replaces a password with a cryptographic key stored on a device, unlocked by a fingerprint, face or PIN. There is nothing to type, nothing to steal in a data breach and nothing to give away on a fake page. Adoption is growing quickly, and many business services now support them.
Least privilege
- Give each person only the access their role needs, and remove it when their role changes.
- Use separate accounts for administrator work and email or browsing.
- Grant temporary elevated access for specific tasks rather than permanent rights.
- Treat service accounts and application keys like people: give them owners, limits and expiry dates.
Access reviews and clean-up
Every quarter, ask managers to confirm who has access to what, and remove anything unneeded. Disable accounts on the day someone leaves. Our identity and access and user access audit services automate much of this checking.
Smarter sign-in rules
Conditional access lets you set rules such as requiring stronger checks from unfamiliar countries, blocking old protocols and demanding a managed, up-to-date device for sensitive apps. Combined with monitoring for impossible travel and odd sign-ins from threat detection, it catches many account takeovers early.
Further reading
Independent sources we recommend for more detail.