Treat identity as your new security perimeter. Firewalls still matter. Endpoint tools still matter. But attackers now go straight for logins, tokens, sessions, and admin rights. If your IAM program is messy, your whole security program feels wobbly.
TLDR: IAM news is all about passkeys, identity threat detection, zero trust access, and tighter control of privileged accounts. Stolen credentials still cause huge pain. For example, IBM’s 2024 breach report put the average data breach cost at $4.88 million. A simple case: if a help desk account has weak MFA, one fake support call can turn into a full cloud takeover.
IAM is not boring anymore
Identity and Access Management used to sound like paperwork with passwords. Not now. IAM is where many attacks begin. It is also where many attacks can be stopped fast.
Modern IAM covers a lot:
- Who gets access.
- What they can touch.
- When they can use it.
- How they prove who they are.
- Why they need that access.
That last point matters. “Because I had it last year” is not a good reason. It is how old permissions turn into quiet security holes.
Key IAM developments making news
First, passkeys are moving from buzzword to real work. Apple, Google, Microsoft, and many service providers now support them. Passkeys use cryptography instead of shared passwords. Users sign in with a device, PIN, fingerprint, or face scan. There is no password to phish. That is a big deal.
Second, identity threat detection is getting more attention. Security teams want tools that spot risky identity behavior. Think impossible travel. New admin roles at 2 a.m. Strange token usage. A service account logging in from a new country. These signals can catch trouble before data walks out the door.
Third, machine identities are now a boardroom problem. Servers, containers, APIs, bots, and apps all need identities. Many companies have more machine identities than human users. Some have thousands. Some have millions. If certificates, secrets, and API keys are not tracked, attackers get a silent side door.
Fourth, regulators and cyber insurers are asking harder questions. They want proof. Not vibes. They ask about MFA, privileged access, logging, reviews, and incident response. “We think access is fine” will not cut it anymore.
Authentication trends: goodbye password drama
Password fatigue is real. It drives me crazy that some systems still ask users to rotate complex passwords every 60 days, then act shocked when people reuse them. The result is sticky notes, weak patterns, and support tickets.
The stronger trend is phishing resistant authentication. This includes:
- Passkeys for consumer and workforce apps.
- FIDO2 security keys for admins and high risk users.
- Certificate based access for managed devices.
- Risk based MFA that adapts to user behavior.
Risk based MFA is useful when done well. A user on a known laptop, in a normal location, may get a smooth login. A user on a new device in another country gets challenged. That makes security less annoying.
The catch is, bad tuning can make it painful. Users may spend 30 extra seconds approving prompts for routine tasks. That sounds small. Across 5,000 workers, it becomes a daily pile of wasted time.
Image not found in postmetaThe identity threats that keep showing up
Attackers love identity because it is efficient. Why hack a server if you can sign in like a real employee?
Here are the big threats:
- Credential phishing: Fake login pages still work too often.
- MFA fatigue: Attackers spam push requests until someone taps approve.
- Session hijacking: Stolen cookies can skip passwords and MFA.
- Token theft: Cloud and SaaS tokens can open many doors.
- Help desk social engineering: Attackers trick support teams into resetting access.
- Over privileged accounts: Users have more access than they need.
- Forgotten accounts: Old accounts sit around, waiting to be abused.
The MGM Resorts attack in 2023 showed how damaging social engineering can be. Widely reported 2024 attacks against Snowflake customer accounts also put focus on stolen credentials and missing MFA. Different cases. Same lesson. Identity controls cannot be soft.
Enterprise security priorities for IAM
Security teams have limited time. So IAM work must be practical. Start with the controls that reduce the most risk.
1. Make MFA stronger
Basic MFA is better than nothing. But push approvals and SMS codes are weaker than many teams think. Move high risk users to FIDO2 keys, passkeys, or certificate based access. Start with admins, developers, finance staff, and help desk users.
2. Cut standing admin access
Permanent admin rights are risky. Use just in time access. Give admin rights only when needed. Set time limits. Record sessions. Require approval for sensitive actions.
3. Review access often
Access reviews can be dull. They are still needed. Keep them short and focused. Review critical apps first. Remove access for inactive users. Watch shared accounts. Shared logins are a mess. Nobody knows who did what.
4. Protect service accounts and secrets
Service accounts often sit in the shadows. They may have strong access and weak oversight. Rotate secrets. Store them in a vault. Remove hard coded API keys from scripts. Track owners. If nobody owns an account, disable it or investigate it.
5. Watch identity signals in real time
Logs are not useful if nobody reads them. Connect IAM logs to your SIEM or security platform. Alert on risky changes. New admin role? Alert. MFA disabled? Alert. Login from odd geography? Alert. Token used from an unknown device? Alert.
Zero trust is really an identity program
Zero trust is often sold as a grand idea. In practice, it starts with simple questions.
- Is this user real?
- Is this device trusted?
- Is this app allowed?
- Is this action normal?
- Should access continue right now?
That means identity must work with device security, network access, cloud policy, and data protection. The goal is not to block everyone. The goal is to give the right access, for the right reason, for the right amount of time.
What leaders should ask this quarter
Executives do not need to master every IAM setting. But they should ask sharp questions.
- How many users have admin access?
- How many inactive accounts exist?
- Which apps still lack MFA?
- Do we use phishing resistant MFA for admins?
- Can we disable access within minutes after termination?
- Who owns service accounts and API keys?
- Do we test help desk reset procedures?
If the answers are fuzzy, there is work to do. Honestly, it feels like many companies buy fancy IAM tools, then leave old exceptions everywhere. Attackers love exceptions. They read like welcome mats.
The simple IAM roadmap
Do not try to fix everything at once. Use a clean 90 day plan.
- Days 1 to 30: Find critical apps, admins, stale accounts, and MFA gaps.
- Days 31 to 60: Enforce stronger MFA for high risk users. Remove unused access.
- Days 61 to 90: Add identity alerts, tighten service accounts, and test recovery flows.
IAM is now a front line defense. Keep it simple. Reduce password use. Limit privilege. Watch strange behavior. Clean up old access. Do those things well, and attackers have a much harder day.
