Enterprise identity security has moved from an IAM team concern to a board-level priority - and the 2025 threat data make it impossible to argue otherwise. The Verizon 2025 Data Breach Investigations Report found that stolen or misused credentials appeared in the majority of confirmed enterprise breaches, marking the third consecutive year that login abuse has topped the initial access charts. Attackers are not breaking in. They are signing in.
Source: CrowdStrike Global Threat Report (year-over-year series)
| Value (%) | Malware-free intrusion share |
|---|---|
| 2022 | 62% |
| 2023 | 71% |
| 2024-2025 | 79% |
What the 2025 threat reports actually show
The credential problem is not a plateau - it is an acceleration. The IBM X-Force Threat Intelligence Index 2025, released in February, documented roughly a 30% year-over-year rise in identity-based intrusions across industries, with valid account abuse now the single most common initial access technique globally. That figure spans financial services, healthcare, manufacturing, and critical infrastructure alike, meaning no sector gets to treat this as someone else's problem.
CrowdStrike's 2025 Global Threat Report adds an uncomfortable dimension: approximately 79% of all detections the firm tracked involved no malware whatsoever - attackers relying entirely on legitimate credentials and built-in system tools. That share was 71% the year before and roughly 62% two years prior. The trend line is unambiguous. Traditional endpoint detection, while still necessary, is increasingly looking at intrusions that generate none of the signals it was built to catch.
Microsoft's Entra team reported in early 2025 that adversary-in-the-middle phishing kits capable of intercepting MFA tokens more than doubled in deployment year-over-year. These kits are now commercially available on underground markets, which means the skill threshold for bypassing legacy MFA has dropped substantially. An attacker no longer needs sophisticated tooling - they need a credit card and a phishing template.
Seventy-nine percent of detections involved no malware at all, according to CrowdStrike - attackers are using your own tools and credentials against you.
Why perimeter and endpoint controls are no longer sufficient
The practical implication of malware-free intrusions is that much of the enterprise security stack is watching the wrong channel. Firewalls, intrusion detection systems, and endpoint agents are calibrated to flag anomalous software behavior. When an attacker authenticates with a legitimately phished credential and then moves laterally using standard administrative tools, those controls produce minimal signal. The breach looks, at the network layer, like an authorized session.
This is the architectural gap that identity threat detection and response - ITDR - is designed to address. Gartner's research from late 2024 and early 2025 positions ITDR as a mandatory layer in enterprise security architectures by 2027, not an optional enhancement. That timeline should prompt CISOs to treat ITDR evaluation as a near-term procurement question rather than a roadmap placeholder. Organizations waiting for ITDR to mature further may find they are funding the analysis of breaches that have already occurred.
CISA has reinforced this through its Known Exploited Vulnerabilities catalog, which surpassed 1,200 entries as of mid-2025, with a disproportionate share enabling credential theft or privilege escalation. The agency's updated guidance in early 2025 explicitly identifies identity hygiene as the top control gap in enterprise environments - a signal that regulators and sector-specific oversight bodies are increasingly aligned on where organizations are falling short.
Compliance pressure is compounding the urgency
For CIOs and CISOs who need a board-facing narrative, the regulatory environment is providing it. The SEC's cybersecurity disclosure rules require material incident reporting within tight windows, and an organization unable to demonstrate proactive identity controls will face hard questions about whether a credential-based breach was foreseeable and preventable. NIS2 in Europe places similar accountability on leadership for the adequacy of access controls across critical systems.
Sector-specific CISA guidance now explicitly calls for phishing-resistant MFA - not just any MFA - across federal and critical infrastructure environments, and that language is migrating into procurement requirements and audit frameworks in the private sector. Organizations that have deployed SMS-based or push-notification MFA and consider the box checked are carrying a compliance exposure they may not have fully modeled yet.
What IT leaders should prioritize now
The immediate operational priority is an honest inventory of MFA coverage and quality. Phishing-resistant MFA - FIDO2 hardware keys and passkeys chief among the options - should be mandated for privileged accounts, remote access pathways, and any system handling sensitive data or financial transactions. The Microsoft AiTM data make clear that legacy MFA is not an adequate control against the current generation of phishing kits.
Beyond MFA, continuous authentication and behavioral analytics within identity platforms can catch the anomalies that static authentication cannot. ITDR tools that integrate with identity providers, directory services, and SIEM pipelines give security operations teams the visibility needed to detect impossible travel, unusual privilege escalation, or lateral movement patterns that emerge after a clean login. Evaluating two or three ITDR vendors this quarter is a concrete step; waiting for the next budget cycle is not a strategy.
Finally, privileged access governance deserves a structured review. CrowdStrike's data on malware-free intrusions largely describes attackers who gain a foothold through one credential and then escalate or move laterally using access that should not have existed or should have expired. Just-in-time privileged access, session recording for administrative accounts, and aggressive deprovisioning of dormant accounts are controls that reduce the blast radius of any credential compromise - and that auditors and regulators will expect to see documented.
