Identity Is the New Security Perimeter: Five Zero Trust Lessons for Australian Businesses

A busy week in cybersecurity has reinforced a simple business reality: attackers do not need to break through every part of your network if they can compromise one trusted identity, token, administrator or access pathway.

From a critical Cisco identity platform vulnerability to new guidance on cloud tokens and growing concern about AI agents, the latest news points to the same priority for organisations of every size: verify access continuously, limit permissions and know exactly which identities can reach sensitive systems.

1. A critical Cisco identity flaw shows why security infrastructure needs urgent patching

Cisco disclosed a critical authentication bypass vulnerability in Identity Services Engine, or ISE, on 16 September 2026. The flaw, tracked as CVE-2026-76460, has a maximum CVSS score of 10.0 and could allow an unauthenticated remote attacker to bypass authentication through an affected API endpoint. Cisco says there is no workaround and directs customers to apply the relevant software update.

ISE is commonly used to control access to networks and devices. It can sit at the centre of a zero trust programme by checking whether a user or device should connect to corporate resources. That makes a weakness in the identity control plane especially serious. If the system that decides who can connect is compromised, other security controls may be undermined at the same time.

Security media also reported that the vulnerability was added to the US Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalogue, with federal agencies given a short remediation window. Even where a small or mid-sized organisation does not use Cisco ISE, the broader lesson still applies: identity infrastructure is high-value security infrastructure, not just another application to patch when convenient.

For business leaders, the risk includes unauthorised network access, service disruption, investigation costs and a difficult conversation with customers or insurers. A compromised access-control platform may also create uncertainty about which devices, administrators or systems can still be trusted.

Practical steps to take:

• Check whether Cisco ISE, ISE Passive Identity Connector or related identity appliances are present in your environment, including systems managed by an IT provider.
• Confirm the affected version and apply Cisco’s fixed release as soon as possible, following the vendor’s security advisory.
• Review internet exposure and restrict management interfaces to approved administration networks, VPN alternatives or dedicated management access paths.
• Search authentication, administrator and API logs for unusual activity from unfamiliar accounts, locations or devices.
• Add identity platforms to your highest-priority vulnerability list so they receive emergency treatment when a critical issue is announced.

2. NIST and CISA put cloud access tokens firmly on the security agenda

The US National Institute of Standards and Technology finalised new guidance on protecting tokens and assertions from forgery, theft and misuse on 15 September. The guidance was produced with the Cybersecurity and Infrastructure Security Agency and is aimed primarily at government agencies and cloud service providers, but NIST says it is relevant to any organisation that relies on identity tokens.

Tokens are the behind-the-scenes credentials that allow browsers, applications and services to continue accessing cloud resources after a user has authenticated. They support single sign-on, application programming interfaces and many zero trust workflows. If a token is stolen or forged, an attacker may be able to move through a trusted session without needing the original password.

The guidance highlights token signing keys, token storage, revocation, sharing of security signals and the responsibilities of cloud providers and customers. It also includes considerations for artificial intelligence and future migration to post-quantum cryptography.

This matters to smaller organisations because cloud identity is now part of almost every business process. Email, accounting, customer relationship management, file sharing, payroll and backup systems may all depend on tokens. A company can have strong passwords and multifactor authentication in place, yet still face risk if sessions remain active for too long or if service tokens are poorly managed.

The practical implication is not that every business needs to build a specialist cryptography team. It is that token security should be included in supplier reviews, incident response plans and identity audits. The new NIST guidance is a useful reference point for questions to ask technology providers.

Practical steps to take:

• Ask key cloud vendors how they protect signing keys, session tokens and application credentials.
• Review the lifetime and revocation process for administrator sessions, API keys, service accounts and refresh tokens.
• Confirm that staff can quickly revoke active sessions when an account is compromised or an employee leaves.
• Avoid storing credentials or tokens in email, shared documents, scripts or unmanaged developer tools.
• Include token theft in tabletop exercises, with a clear process for disabling sessions, rotating secrets and checking for persistence.

3. A rogue external MFA provider demonstrates that trust can be abused inside a legitimate login

Security researchers at Varonis described a technique called TrustSink on 16 September. The technique targets Microsoft Entra environments where an attacker with sufficient administrative privileges can register a rogue external authentication provider. During an otherwise legitimate sign-in process, the provider can display a convincing password page, collect the user’s password and then return a valid-looking authentication result to the identity platform.

The important point is not the name of the technique. It is the way the attack abuses a legitimate trust relationship. Organisations often focus on whether multifactor authentication is enabled, but an identity system can still be exposed if external authentication integrations, privileged roles or federation settings are not carefully governed.

This is especially relevant for businesses that use multiple cloud applications, outsourced IT services or third-party identity tools. Every additional connector can improve convenience, but it can also expand the number of places where a high-privilege change could affect the sign-in experience.

For managers, this is a reminder that MFA is not a single checkbox. The security of MFA depends on the authentication method, the recovery process, the administrators who can change it and the integrations that sit around it. The same principle applies to service desks. A helpdesk worker who can reset authentication methods may hold a role that is more sensitive than its title suggests.

Practical steps to take:

• Review every external authentication method, federation connection and custom identity provider configured in your tenant.
• Limit the ability to add or modify authentication providers to a very small number of administrators.
• Require strong, phishing-resistant MFA for privileged administrators, preferably passkeys or FIDO2 security keys.
• Alert on new authentication methods, provider changes, privileged role assignments and unusual sign-in flows.
• Strengthen account recovery by requiring independent verification and documented approval for high-risk resets.

4. Microsoft expands Zero Trust thinking to local AI agents and agent traffic

A Microsoft Security update published on 24 September highlighted new capabilities aimed at discovering and controlling local AI agents, extending Zero Trust controls to agent traffic and strengthening security operations for an AI-enabled environment.

AI agents are no longer limited to a chatbot window. They may run on employee devices, connect to business applications, read files, call APIs or perform tasks across a workflow. In some cases, an agent can act with the permissions of a user or a service account. That creates a new identity challenge: organisations must understand not only who a person is, but also what automated software is doing on that person’s behalf.

The news is part of a wider industry shift. On 22 September, a group of technology and security companies announced the Blueprint Alliance, which is promoting principles such as treating each AI agent as a distinct identity, limiting access to a specific task, recording delegation and monitoring behaviour continuously.

For small and mid-sized businesses, the immediate risk is often shadow AI. An employee may connect a productivity tool to a company mailbox, cloud drive or customer database without the IT team knowing. The tool may be useful, but the access can remain long after the original task is complete. If an account is compromised, the connected agent may provide another route into company data.

Businesses do not need to stop using AI. They do need to apply familiar identity principles to it: know what exists, give it only the permissions it needs, log what it does and make it easy to disable.

Practical steps to take:

• Create a simple register of approved AI tools, connected applications, automations and agents.
• Treat each agent, integration and service account as an identity with an owner, purpose and expiry or review date.
• Start with read-only access and expand permissions only when there is a documented business case.
• Block unsanctioned connections to email, file storage, finance systems and customer databases.
• Monitor unusual agent activity, including bulk downloads, new external destinations and actions outside normal business hours.

5. Zero Trust is becoming a practical operating model, not a technology slogan

The week’s news also reflects a more mature view of Zero Trust. It is no longer just a long-term architecture project or a product category. It is becoming a way to make daily access decisions based on identity, device health, location, application, risk and the sensitivity of the requested resource.

Microsoft’s recent security guidance describes the continuing problem as one of connected weaknesses: excessive permissions, exposed authentication flows, unpatched systems and gaps between controls. A compromised identity may move from an email account to cloud storage, collaboration tools, administrative settings and business applications unless each step is checked.

For Australian businesses, this approach aligns with practical expectations around privacy, resilience and reasonable security controls. It also supports conversations with insurers, auditors, customers and larger supply-chain partners. A business that can demonstrate strong access controls, timely patching, clear offboarding and useful logs is in a better position to prevent incidents and explain its response.

Zero Trust does not mean buying every security product on the market. For many organisations, the first stage is a disciplined review of the access that already exists. Which accounts have administrator rights? Which contractors still have access? Which systems rely on shared passwords? Which applications have never been reviewed? Which devices can connect even when they are unpatched or unmanaged?

Practical steps to take:

• Map your most important business systems and identify the identities that can access them.
• Remove dormant accounts, shared administrator credentials and unnecessary standing privileges.
• Use conditional access to consider device health, location, risk and application sensitivity.
• Replace broad network access with application-specific access wherever practical.
• Centralise identity and security logs so unusual access can be investigated quickly.

What This Means For Your Business

The common thread across this week’s identity and Zero Trust news is straightforward: trust must be earned continuously. A password, an MFA prompt, a cloud token, a service account or an AI agent should not receive unlimited access simply because it was approved once.

Start with the basics. Confirm which identity systems and access-control products your organisation uses. Check for urgent patches, review privileged accounts and make sure terminated staff and suppliers are removed promptly. Then focus on the access pathways that could cause the greatest damage, such as email, finance, customer data, backups and administration consoles.

Over the next quarter, aim to improve visibility rather than chase perfection. Maintain an inventory of human and non-human identities, introduce stronger authentication for administrators, review third-party integrations and test your response to a stolen session or compromised account. If internal resources are limited, an experienced managed IT or security partner can help prioritise the work and provide continuous monitoring.

The goal is practical resilience. When every access request is evaluated, permissions are limited and suspicious activity is visible, a single compromised identity is less likely to become a business-wide crisis.

Call Webwire on 08 9386 0053 or contact us at enquiries@webwire.com.au.