Identity Is the New Security Perimeter: Four Cybersecurity Signals Businesses Cannot Ignore

The latest technology and cybersecurity news points to one clear conclusion: attackers are targeting the identities, sessions and automated permissions that keep modern businesses running.

For small and mid-sized organisations, the message is practical rather than theoretical. Strong passwords alone are not enough, and buying another security tool will not solve an access problem that nobody has mapped properly.

1. Microsoft 365 phishing campaigns are moving beyond passwords

A recent investigation by CloudSEK exposed BigBear 2.0, a phishing-as-a-service operation aimed at Microsoft 365 users across more than 40 countries. The campaign used adversary-in-the-middle techniques to capture credentials, session cookies and authenticated sessions. Reported data included thousands of stolen credentials and session records, including logins that had already passed multifactor authentication.

The campaign is important because it shows how attackers are changing their objective. Instead of simply stealing a password, they increasingly try to steal the active session that proves a user has already authenticated. That can allow an attacker to operate inside a cloud account while appearing to be a legitimate user.

According to the CloudSEK investigation, BigBear 2.0 was still active when the research was published on September 7, 2026. A separate industry report described related campaigns using fake IT support calls and convincing Microsoft 365 login pages to obtain access.

Why it matters for businesses

Microsoft 365 is often the centre of a small business environment. It may contain email, financial documents, customer records, intellectual property and access to other cloud services. A compromised mailbox can also be used to reset passwords, impersonate executives or redirect payments.

MFA remains essential, but businesses should understand that not every form of MFA offers the same resistance to phishing. Number matching, push approvals and one-time codes can still be abused when a user is persuaded to authenticate through a malicious relay.

Practical actions to take

• Prefer phishing-resistant authentication such as passkeys or hardware security keys for administrators, finance staff and remote access users.
• Review sign-in logs for unfamiliar locations, impossible travel, new devices, unusual session activity and repeated MFA prompts.
• Require administrator approval for new mailbox forwarding rules, OAuth application consent and high-risk account changes.
• Train staff to treat unexpected IT support calls, urgent password requests and login links as possible security incidents.
• Create a simple response playbook for stolen sessions, including forced sign-out, token revocation, password reset and review of mailbox rules.

2. Non-human identities are becoming a major access risk

A new identity threat report highlighted a risk many smaller organisations have not yet addressed: non-human identities. These include service accounts, API keys, access tokens, automation accounts and AI agents that connect systems without a person typing a password.

The report, covered by CSO Online, found that compromised non-human identities were identified by respondents as the leading route into the enterprise. The research also reported a significant gap between organisations that believe they can see their machine identities and those that actively monitor them.

The trend is easy to understand. Businesses are adopting cloud software, integrations, customer portals, automated workflows and AI tools faster than they are documenting the permissions behind them. A forgotten API key may continue working for months after the employee who created it has left. A service account may have access to far more data than the application actually needs.

Why it matters for businesses

Non-human identities do not take annual leave, change jobs or respond to security awareness training. They can also be difficult to spot because their activity may look like normal system traffic.

If an attacker obtains a valid API key or service token, traditional controls may not raise an obvious alarm. The attacker may not need to bypass a login page at all. They can use the stolen identity to query data, alter workflows or move between connected services.

For Australian businesses, the issue also has governance implications. A weakly controlled machine identity can expose personal information, disrupt operations and create difficult questions about access control, supplier oversight and incident response.

Practical actions to take

• Build an inventory of service accounts, API keys, tokens, integrations and automated workflows.
• Assign a business owner to every non-human identity, not just a technical owner.
• Replace long-lived credentials with short-lived tokens and workload identity where the platform supports it.
• Apply least privilege so each service can access only the systems and data required for its job.
• Set expiry dates, rotate secrets regularly and alert on dormant, unusual or geographically unexpected use.

A useful first step for a smaller organisation is to examine the password manager, cloud console and software-as-a-service administration portals for shared credentials and integrations nobody can explain. Unknown access is unmanaged access.

3. AI workflows are creating a new authorisation blind spot

AI agents are moving from answering questions to taking actions. They can read support tickets, update records, create code, search documents and call other software tools. That creates a new identity challenge: the person who starts a workflow may not be the same entity that ultimately performs every action.

A recent report described a technique called workflow identity hijacking. Researchers warned that an attacker could submit a normal-looking request through an unauthenticated channel, such as a support inbox, shared document or issue tracker, and cause an AI-enabled workflow to perform privileged actions. The findings were reported by CSO Online.

The concern is not that every AI tool is automatically unsafe. The problem is that organisations may be applying familiar access controls at the front door while failing to check permissions at every downstream action.

An AI system may be allowed to read a customer email, for example, but that does not mean it should be allowed to change a billing record, approve a refund or invite a new administrator. Each action needs its own policy and audit trail.

Why it matters for businesses

AI can amplify both productivity and mistakes. If an agent has excessive permissions, a single malicious instruction, poisoned document or compromised integration could trigger a chain of actions across multiple systems.

This is particularly relevant to businesses using customer service automation, sales tools, accounting workflows, recruitment systems and software development assistants. The risks include unauthorised disclosure, incorrect transactions, regulatory exposure and reputational damage.

The principle of zero trust applies here in a more precise way than the familiar slogan suggests. The organisation should verify not only who initiated a request, but also which agent is acting, what tool it is calling, what data it can reach and whether the proposed action is appropriate in context.

Practical actions to take

• Give every AI agent a distinct identity rather than allowing it to operate under a shared human account.
• Separate read, write, approve and administer permissions.
• Require human approval for payments, data exports, account changes, external communications and privilege escalation.
• Log prompts, tool calls, decisions and resulting changes so unusual activity can be investigated.
• Test AI workflows with malicious instructions, poisoned documents and requests that attempt to bypass normal approval steps.

Before deploying a new agent, write down the worst action it could take if compromised. Then design controls specifically to prevent that action. This simple exercise often reveals that the proposed permissions are much broader than the business need.

4. A critical Cisco firewall management vulnerability reinforces the need for rapid patching

Cisco updated its advisory for a critical authentication bypass in Secure Firewall Management Center software on September 9, 2026. The company said the flaw, tracked as CVE-2026-20079, could allow an unauthenticated remote attacker to bypass authentication, execute scripts and obtain root access to the underlying operating system. Cisco rated the vulnerability 10.0 on the CVSS scale and said active exploitation had been observed.

The Cisco security advisory says there are no workarounds and recommends upgrading to a fixed software release. Organisations that suspect compromise are advised to seek assistance and review the listed indicators of compromise.

This story is not only about Cisco customers. It is a reminder that identity controls are often embedded in infrastructure management systems. A management interface that accepts unauthenticated requests can undermine network segmentation, firewall policy and remote access protections in one step.

Why it matters for businesses

Small and mid-sized organisations often rely on managed service providers or a small internal IT team to maintain firewalls and network appliances. That can create a dangerous assumption that infrastructure is being patched automatically.

A device does not need to be a public-facing website to be exposed. Remote administration portals, VPN gateways, management interfaces and supplier connections can all become entry points. When a vulnerability is actively exploited, the time available for a comfortable maintenance window may disappear.

Practical actions to take

• Confirm whether your organisation or IT provider manages an affected Cisco Secure Firewall Management Center deployment.
• Apply the vendor fix as soon as practical and record the change for audit purposes.
• Restrict management interfaces to approved administrative networks, VPNs or zero trust access brokers.
• Review logs for unexpected administrator activity, new accounts, configuration changes and unusual outbound connections.
• Keep an up-to-date register of internet-facing systems, appliance versions, owners and emergency contacts.

If patching cannot happen immediately, document the risk, apply the strongest available access restrictions and increase monitoring. Temporary risk acceptance should have an owner and an expiry date.

What This Means For Your Business

The common thread across this week’s stories is that attackers are targeting trust. They are abusing trusted Microsoft 365 sessions, trusted service accounts, trusted automation and trusted management interfaces. A perimeter-only strategy cannot provide enough protection when legitimate identities can be copied, delegated or misused.

The answer is not to stop using cloud services, automation or AI. It is to make access more deliberate. Start by identifying your most important systems, the human and machine identities that can reach them, and the actions that would cause serious harm if performed without approval.

For most organisations, the first 30 days should focus on visibility and basic control. Review privileged accounts, remove dormant access, enable phishing-resistant MFA where available, check critical vendor advisories and document every service account. The next stage is stronger monitoring, short-lived credentials and policies that verify access continuously rather than trusting a user or device indefinitely.

Zero trust is best approached as a business discipline, not a single product purchase. By reducing unnecessary access, protecting sessions, governing automation and patching exposed infrastructure quickly, businesses can lower cyber risk without slowing down everyday work.

Call Webwire on 08 9386 0053 or contact us at enquiries@webwire.com.au.