Cloud Identity Compromise - Driving 80% of 2025 Incidents

What Happened

A recent report from Field Effect revealed that compromised cloud identities were responsible for over 80% of security incidents in 2025. This marks a significant change in how attackers operate. Instead of exploiting software vulnerabilities, they logged in using valid credentials. Earl Fischl, Director of Security Services, emphasized that identity has become the main target for cybercriminals.

Attackers have been using trusted collaboration tools like Microsoft Teams and Zoom to blend into normal business activities. One notable campaign involved impersonating IT help desks to trick employees into granting remote access. This tactic led to credential harvesting, lateral movement within networks, and even ransomware deployment.

Who's Being Targeted

Organizations of all sizes are at risk, particularly those utilizing cloud services heavily. Employees in companies using tools like Microsoft Teams and Quick Assist are prime targets. The report suggests that attackers are increasingly focusing on edge infrastructure, including VPN appliances and firewalls, often using reused credentials to gain access.

The rise of generative AI has also played a role, allowing attackers to scale their methods quickly. This means that even small organizations can become victims of sophisticated attacks, as the barriers to entry for cybercriminals continue to lower.

Signs of Infection

Organizations should be vigilant for signs of compromised identities. Some indicators include unusual login attempts, especially from unfamiliar locations, and unexpected requests for remote access. Employees might notice strange behavior in collaboration tools, like unsolicited messages from supposed IT personnel.

To mitigate these risks, businesses must enhance their identity security measures. This includes implementing multi-factor authentication (MFA) and regularly monitoring access logs for anomalies. Training employees to recognize phishing attempts and suspicious activity is also crucial.

How to Protect Yourself

Organizations can take several steps to strengthen their defenses against identity compromise. First, they should prioritize identity security by implementing robust authentication methods. Regularly updating passwords and educating employees about secure practices is essential.

Improving visibility into user activities can help organizations detect potential breaches early. By monitoring access patterns and employing security analytics, companies can identify and respond to threats more effectively. Fischl advises that while organizations cannot control the intent of attackers, they can significantly reduce opportunities for compromise through proactive security measures.