Identity Is the New Security Perimeter: Four Access and Zero Trust Lessons for Business Leaders

A clear pattern has emerged in the latest technology and cybersecurity news: attackers are not waiting at the network edge. They are targeting the identities, tokens, authentication methods and access paths that businesses use every day.

For small and mid-sized organisations, the message is practical rather than theoretical. Stronger identity controls, better monitoring and disciplined access policies can reduce the impact of an attack without requiring a major security transformation project.

1. Passkey lures are being used to defeat familiar MFA routines

Microsoft Security has reported an active campaign in which attackers use help desk impersonation, passkey-themed messages and fake sign-in pages to compromise cloud identities. The activity has been observed since May 2026 and involves a sequence that can include stolen credentials, session token theft, unauthorised authentication method registration, cloud reconnaissance and data collection from services such as SharePoint, OneDrive and Exchange.

The important point is that the campaign does not necessarily attack passkeys themselves. Instead, passkeys and single sign-on are used as believable themes. A user may be told that an account needs to be upgraded, re-registered or urgently verified. The attacker then guides the person through a device-code flow or an adversary-in-the-middle phishing page.

Once access is obtained, the attacker may add a new authentication method under their own control. That creates persistence and makes the incident more difficult to spot. The account can then be used to explore applications, directories and cloud files in a way that looks like normal activity when individual events are viewed in isolation.

According to Microsoft Security research, organisations should investigate identity events as a connected sequence rather than treating each unusual sign-in, new MFA method or file download as a separate issue.

Why it matters for businesses

Small businesses often rely on Microsoft 365, Google Workspace, cloud accounting, customer relationship platforms and remote support tools. A single compromised administrator or finance account can expose sensitive information, enable invoice fraud or provide a route into other systems.

The risk is also human. Employees are accustomed to receiving urgent messages from IT teams, software vendors and service providers. A convincing call or chat message can turn a routine security process into an entry point for an attacker.

Practical actions

• Create a clear rule that staff must never approve an unexpected MFA request or register a new authentication method during an unsolicited call.
• Use a known internal phone number or service desk channel to verify requests involving passwords, MFA, passkeys or account recovery.
• Restrict who can register authentication methods and require stronger sign-in conditions for security information changes.
• Block device-code authentication flows unless there is a documented business need.
• Review alerts for new MFA methods, unusual sign-ins, unfamiliar devices, impossible travel and high-volume cloud downloads.
• Revoke active sessions and remove unauthorised authentication methods immediately when an account is suspected of compromise.

2. Passkeys are moving from security option to default expectation

Microsoft has begun rolling out passkeys as the default authentication experience in Microsoft Entra ID for users who have been relying on SMS or voice authentication. The change began on September 1, 2026, with Microsoft providing further information about telecom options on September 18. Microsoft-provided SMS and voice authentication is scheduled to end on February 1, 2027, although some organisations may be able to use customer-managed providers for specific requirements.

The shift reflects a broader change in the security baseline. Passwords remain vulnerable to reuse, phishing and credential stuffing. SMS and voice codes are better than passwords alone, but they can still be intercepted, redirected or socially engineered. Passkeys use cryptographic credentials tied to a device, security key or platform authenticator and are designed to resist common phishing techniques.

The transition will not be equally simple for every organisation. Some users may have older devices, shared accounts, unusual recovery requirements or operational dependencies on text messages. Australian businesses also need to consider contractors, frontline staff and regional workers who may not have consistent access to managed devices.

Microsoft has published a passkey and SMS retirement timeline that gives organisations a useful planning framework.

Why it matters for businesses

Authentication changes can create both security and operational risk. A rushed rollout may lock out users or encourage unsafe workarounds. A delayed rollout may leave high-risk accounts dependent on phishable methods while attackers are actively using social engineering to target MFA and account recovery.

Passkeys can also improve the user experience. When deployed well, they reduce password resets, limit phishing exposure and give staff a faster sign-in process. That can lower support costs over time.

Practical actions

• Identify every account still using SMS or voice authentication, with priority given to administrators, finance staff and remote access users.
• Pilot passkeys with a small group that represents different devices, roles and working locations.
• Provide at least one secure recovery method that does not depend on a phishable password or text message.
• Document account recovery procedures and train the service desk to resist social engineering pressure.
• Keep an inventory of shared, service and break-glass accounts, then move them towards managed identities or stronger privileged access controls.
• Communicate the change early so staff understand that a passkey prompt is part of a planned security program, not something to complete through an unexpected link or phone call.

3. NIST and CISA put cloud access tokens firmly on the risk register

A new publication from the US National Institute of Standards and Technology and the Cybersecurity and Infrastructure Security Agency focuses on protecting tokens and assertions from forgery, theft and misuse. The guidance was finalised on September 15, 2026.

Tokens are small digital artefacts that allow applications and services to recognise an authenticated user and continue providing access. They support single sign-on, cloud applications and many zero trust architectures. They are convenient because users do not need to authenticate from scratch for every action. They are also valuable to attackers because a stolen or forged token can sometimes provide access without the original password.

The guidance was written primarily for federal agencies and cloud service providers, but NIST has made clear that the principles are relevant to commercial organisations using token-based access. It covers areas including cryptographic key protection, token handling, revocation, sharing security signals and emerging considerations related to artificial intelligence and post-quantum cryptography.

The publication refers to an incident in which attackers used forged tokens derived from a stolen commercial signing key to access an agency email environment and steal more than 60,000 messages. The example shows why identity security cannot stop at the sign-in screen.

The NIST publication on token protection is particularly useful for businesses reviewing cloud architecture, supplier assurance and incident response plans.

Why it matters for businesses

A business may have strong passwords and MFA while still leaving long-lived sessions, application tokens, API keys or signing credentials poorly protected. This is especially relevant for organisations that connect multiple cloud platforms, automate finance or operations tasks, or allow third-party applications to access customer data.

Token theft can also complicate incident response. Changing a password may not be enough if active sessions remain valid. The response plan needs to identify where tokens are issued, how long they live, how they are revoked and which logs show their use.

Practical actions

• Ask your IT provider or cloud administrator how sessions, refresh tokens, API keys and application secrets are stored and revoked.
• Set sensible session lifetimes for sensitive applications, particularly administration portals and financial systems.
• Review application consent and remove integrations that are no longer required.
• Protect signing keys and secrets using managed vaults rather than shared documents, email or local configuration files.
• Confirm that incident response procedures include token revocation, session termination and review of application permissions.
• Monitor for a user or application accessing large numbers of files, mailboxes or directories in a short period.

4. A critical Cisco identity platform issue highlights the need for fast patching

Cisco published a series of September security advisories affecting Identity Services Engine, a platform used to manage network access, authentication and policy enforcement. The advisories include authentication bypass, path traversal, information disclosure, injection and session hijacking issues. Cisco released fixed software and advised customers to upgrade.

A separate report highlighted a maximum-severity Cisco ISE issue and noted that the vulnerability had been added to the US Cybersecurity and Infrastructure Security Agency Known Exploited Vulnerabilities catalogue. Federal agencies were given a September 19 remediation deadline. The precise exposure depends on the affected product and software version, but identity infrastructure deserves urgent attention because it often sits between users, devices and critical systems.

The Cisco security advisories demonstrate a wider operational lesson. Security teams must treat identity-adjacent systems as high-value assets, not as ordinary network appliances. A vulnerability in an access control platform may allow an attacker to bypass a security decision, obtain administrative access or weaken controls that protect many other systems.

Why it matters for businesses

Many small and mid-sized organisations do not operate Cisco ISE directly. However, they may depend on a managed service provider, campus network, outsourced IT team or parent company that does. The same principle applies to VPN gateways, remote monitoring tools, firewalls, identity providers and network management consoles.

If a provider manages these platforms on your behalf, you still need visibility. You may be responsible for business impact, customer notification, insurance obligations or regulatory reporting even when the technical system is operated by someone else.

Practical actions

• Ask providers to confirm whether Cisco ISE or another identity-adjacent platform is in use, which versions are deployed and whether patches have been applied.
• Maintain a list of internet-facing management systems, VPN gateways, remote access tools and identity platforms.
• Prioritise vulnerabilities that are actively exploited, remotely accessible or located on systems that control authentication and authorisation.
• Restrict management interfaces to trusted administration networks and require MFA for privileged access.
• Review administrator accounts and remove dormant or shared credentials.
• Test whether access policies still work as intended after a security update or configuration change.

5. Australian guidance reinforces phishing-resistant MFA and session control

The Australian Signals Directorate has updated system access guidance during September and continues to encourage organisations to switch on MFA. The updated material distinguishes between stronger and weaker authentication methods and highlights the value of phishing-resistant methods such as passkeys and security keys.

The guidance also stresses the importance of revoking active sessions and refresh tokens when trust in a user account or device changes. That is a useful reminder for Australian businesses because a compromised account is not always contained by changing a password. Existing sessions may remain active, and a malicious application may continue using an approved token.

The Australian Cyber Security Centre system access guidance provides a practical reference point for organisations working towards the Essential Eight or improving their broader identity controls.

Why it matters for businesses

Australian businesses are increasingly expected to show that security controls are reasonable for the sensitivity of the information they hold. Customers, insurers, partners and regulators may ask how access is protected, how privileged accounts are managed and how quickly a compromised account can be contained.

Zero trust does not have to mean buying a large collection of new products. It means making access decisions based on identity, device health, application, location, risk and the sensitivity of the requested resource rather than assuming that anything inside the network is safe.

Practical actions

• Use MFA for email, remote access, administration portals, finance systems and customer data platforms.
• Prefer passkeys, FIDO2 security keys or other phishing-resistant methods for privileged and high-risk users.
• Apply least privilege and review access at least quarterly, especially after role changes or departures.
• Require managed and healthy devices for access to sensitive systems wherever practical.
• Make sure offboarding removes accounts, application access, sessions, tokens and remote support permissions.
• Record and test the steps your team would take if a senior executive or administrator account were compromised.

What This Means For Your Business

The latest news is not a reason to panic or launch an expensive security project without a plan. It is a reason to treat identity as the control point for modern business technology. Attackers are using social engineering to obtain access, tokens to maintain it and legitimate cloud services to move through an organisation quietly.

Start with the accounts and systems that matter most. Protect administrators, finance staff and executives first. Replace SMS-based authentication where practical, make account recovery harder to abuse and ensure your team can revoke sessions and tokens quickly. If a supplier manages your identity or network platforms, ask for evidence of patching, monitoring and incident response rather than assuming the risk has been transferred.

For most organisations, the next 30 days should include an identity inventory, an MFA review, a privileged access review and a check of internet-facing management systems. These are achievable steps that improve security, support compliance and give business leaders a clearer view of where access risk is concentrated.

Zero trust is best understood as a business discipline, not a product label. Verify every important access request, limit what each identity can reach and monitor for behaviour that does not fit the normal pattern. Those habits will remain valuable as businesses adopt more cloud services, automation and AI-enabled tools.

Call Webwire on 08 9386 0053 or contact us at enquiries@webwire.com.au.