Executive summary
The modern attacker does not always need to break through the perimeter.
Sometimes it is easier to become someone the perimeter already trusts.
As enterprises adopt SaaS, cloud platforms, APIs, federated authentication and machine identities, identity increasingly determines who—or what—can reach applications, data and business processes.
September 2026 highlighted how attackers can exploit the authentication journey itself.
Microsoft documented social-engineering activity involving helpdesk impersonation, passkey-themed lures, adversary-in-the-middle techniques and device-code authentication. Once access was obtained, attackers could move beyond credentials toward sessions, authentication methods, Microsoft Graph reconnaissance and cloud data.
NIST’s September publication of IR 8587, Protecting Tokens and Assertions, reinforces the broader issue: modern identity security must protect not only passwords, but also the tokens and assertions that allow trusted access to persist across cloud environments.
Identity risk has moved beyond the password
| Identity asset | What it enables | Why attackers value it | Defensive priority |
| Password | Initial authentication | Direct account access | Phishing-resistant MFA |
| Session cookie | Existing authenticated session | May bypass repeated authentication | Session monitoring and revocation |
| Refresh token | Continued access | Can extend attacker persistence | Token lifecycle controls |
| OAuth token | Application authorization | Enables API and SaaS access | Application governance |
| Federation assertion | Cross-system trust | Can extend compromise across environments | Federation security |
| Service principal | Machine/application access | May hold significant cloud privilege | Workload-identity governance |
| Privileged identity | Administrative control | Enables high-impact actions | PAM and least privilege |
The security boundary has therefore shifted.
Authentication is an event. Identity security is a continuous process.
What changes are these for banks and enterprises?
1. MFA remains essential—but cannot operate alone
Strong authentication reduces risk, but organizations must also monitor what happens after authentication.
2. Tokens become security assets
Session cookies, OAuth tokens, refresh tokens and federation assertions require lifecycle protection and monitoring.
3. Non-human identities matter
Applications, APIs, service principals, workloads and AI agents increasingly authenticate to enterprise systems without human involvement.
4. Identity compromise can become financial fraud
A compromised identity may expose payment conversations, approval workflows, supplier relationships and transaction processes.
For financial institutions, identity security therefore increasingly connects:
Cybersecurity → Data Protection → Fraud Prevention
The GCC/MENA perspective
Digital banking, fintech, cloud adoption, digital identity and smart-government services are increasing the number of trusted relationships connecting GCC/MENA organizations.
As these ecosystems expand, identity becomes the common control layer connecting:
People • Applications • Partners • APIs • Workloads • AI Agents • Data
For regulated institutions, identity strategy should therefore extend beyond traditional IAM administration toward continuous identity threat detection, privilege governance and Zero Trust enforcement.
Strategic priorities
- Accelerate phishing-resistant authentication for high-risk users.
- Deploy Identity Threat Detection and Response.
- Reduce standing administrative privilege through PAM.
- Monitor unexpected authentication-method changes.
- Protect sessions and tokens, not only passwords.
- Govern service principles and workload identities.
- Correlate identity activity with cloud and endpoint telemetry.
- Connect identity incidents with fraud-monitoring processes.
Executive takeaway
The most dangerous identity may not be an unknown attacker—it may be a legitimate account behaving illegitimately. In cloud-first environments, the security challenge is shifting from proving identity once to continuously proving that trust is still justified.
