The identity attack surface: how initial access brokers get in

Key takeaways

• The majority of enterprise intrusions begin with a valid login, not an exploit — a purchased credential, stolen session token, or exposed remote service.
• Identity is the practical perimeter now: cloud and remote work dissolved the network edge, and the account is the boundary that matters.
• If you can't enumerate every internet-facing entry point and every remote-access account, and say which use phishing-resistant MFA, that inventory is your first project.

The door is usually unlocked, not broken

The majority of enterprise intrusions do not begin with an exotic exploit. They begin with a valid login — a purchased credential, a stolen session token, an exposed RDP or VPN endpoint, or an unmanaged internet-facing device. Initial access brokers specialize in obtaining exactly these footholds and reselling them, which means the entry point into most incidents was, technically, working as designed.

Identity is the new perimeter

This is why identity has become the practical perimeter. Cloud adoption and remote work dissolved the network edge, and the account is now the boundary that matters. Multi-factor authentication helps, but attackers routinely defeat weaker forms of it through push-notification fatigue, token theft, and adversary-in-the-middle phishing kits that proxy the real login page in real time.

The controls that actually move the needle

• Phishing-resistant MFA — FIDO2 security keys or passkeys — on all remote access and every administrative account.
• Aggressive reduction of internet-facing services down to only what must be exposed, with the rest behind a broker or VPN with MFA.
• Monitoring for anomalous session and token use, with the ability to revoke fast.
• Disabling legacy authentication protocols that quietly bypass MFA entirely.

Start by counting the doors

A useful diagnostic: can you enumerate every internet-facing entry point into your environment and every account with remote access, and state which of them use phishing-resistant MFA? If you cannot produce that inventory today, building it is your first project — you cannot defend an attack surface you have not counted.