🚫 Myth 1: “Passwords Are Enough to Protect My Identity”

Reality: Relying solely on passwords is like leaving your front door unlocked

It’s no longer sufficient in today’s threat landscape. According to the Verizon 2026 Data Breach Investigations Report, 80% of breaches involve stolen, weak, or reused passwords. Attackers leverage credential stuffing (using leaked passwords from past breaches), brute-force attacks, and phishing to bypass password-based defences.

Why It’s Dangerous:

• Password reuse is rampant: A Cloudflare 2025 study found that nearly half of observed logins are compromised, largely due to using the same passwords across multiple accounts. If one account is compromised, all accounts using the same password are at risk.
• Brute-force attacks are automated and scalable: Tools like Hydra or John the Ripper can test billions of password combinations per second.
• Phishing attacks trick users into voluntarily handing over credentials. The NCSC’s 2026 Phishing Report found that phishing accounts for 72% of credential theft incidents in the UK.

How to Stay Safe:

✅ Use a password manager (e.g., Bitwarden, 1Password, KeePass) to generate and store unique, complex passwords for each account.

✅ Enable Multi-Factor Authentication (MFA) on all accounts, especially for email, banking, and social media.

✅ Avoid reusing passwords—even a single compromised password can lead to multiple account takeovers.

✅ Use passphrases (e.g., PurpleElephant$JumpedOver23Moon) instead of short, complex passwords (e.g., P@ssw0rd1!).

✅ Use passwordless authentication methods

Source: NIST SP 800-63B (Digital Identity Guidelines)

🚫 Myth 2: “Multi-Factor Authentication (MFA) Is Foolproof”

Reality: While MFA significantly reduces the risk of account takeovers, it is not invincible.

Cybercriminals have developed sophisticated methods to bypass MFA, including MFA fatigue attacks, SIM swapping, and adversary-in-the-middle (AitM) attacks.

Why It’s Dangerous:

• MFA Fatigue Attacks: Attackers bombard users with MFA requests until they accidentally approveone. The CISA 2026 MFA Bypass Report notes a 300% increase in such attacks, with 1 in 5 users eventually approving a fraudulent request.
• SIM Swapping: Attackers trick mobile carriers into transferring a victim’s phone number to a SIM card they control, then intercept SMS-based 2FA codes. The NCSC’s 2026 SIM Swapping Guidance reports a 40% rise in such attacks.
• Adversary-in-the-Middle (AitM) Attacks: Tools like Modlishka or Evilginxintercept MFA tokens in real time, allowing attackers to bypass MFA even if the user enters the correct code.

How to Stay Safe:

✅ Use phishing-resistant MFA (e.g., FIDO2 security keys like YubiKey, or biometric authentication).

✅ Educate users on MFA fatigue attacks and how to respond (e.g., never approve unexpected MFA requests).

✅ Monitor for unusual MFA activity (e.g., multiple failed attempts, requests from unfamiliar devices).

Source: FIDO Alliance Phishing-Resistant MFA

🚫 Myth 3: “Only Large Organisations Are Targeted by Identity Attacks”

Reality: Small and medium-sized enterprises (SMEs) are just as vulnerable…

…often more so – because they typically have weaker security controls. According to the GOV.UK Cyber Security Breaches Survey 2026, 43% of SMEs in the UK experienced a credential-based attack in 2025, a 20% increasefrom the previous year.

Why It’s Dangerous:

• SMEs are “soft targets”: Attackers see them as easier to compromise due to limited budgets, lack of dedicated security teams, and poor cybersecurity awareness.
• Supply chain risks: SMEs are often vendors or partners to larger organisations. Compromising an SME can provide attackers with a backdoor into bigger targets.
• Ransomware focus: 60% of ransomware attacks in 2025 targeted SMEs, as they are more likely to pay ransoms to avoid downtime (source: CISA 2026 Threats and Responses).

How to Stay Safe:

✅ Implement MFA for all accounts, especially admin and privileged users.

✅ Use a password manager to eliminate password reuse.

✅ Train employees on phishing and social engineering risks.

✅ Backup critical data offline and immutably to recover from ransomware attacks.

Source: NCSC SME Cybersecurity Guidance

🚫 Myth 4: “Biometric Authentication Is 100% Secure”

Reality: Biometrics are not infallible

While biometrics (e.g., fingerprints, facial recognition, voice recognition) are more secure than passwords, they are not infallible. Attackers have developed sophisticated methods to spoof or steal biometric data.

Why It’s Dangerous:

• Spoofing Attacks: Deepfake technology can create hyper-realistic fake faces or voices to trick biometric systems. A 2026 Sensity AI Report found that 1 in 4 facial recognition systems can be fooled by AI-generated deepfakes.
• Biometric Database Breaches: If a centralised biometric database is hacked, stolen biometric data cannot be changed like a password. Example: In 2023, Aadhaar (India’s biometric ID system) leaked 1.1 billion records, exposing fingerprints and facial data (source: EPIC Response to UK ICO).
• False Acceptance/Rejection Rates: No biometric system is perfect. False acceptance (letting an imposter in) or false rejection (locking out a legitimate user) can occur, especially with low-quality sensors (e.g., 2D facial recognition on smartphones).

How to Stay Safe:

✅ Use multi-modal biometrics (e.g., fingerprint + facial recognition) to reduce false acceptance rates.

✅ Store biometrics locally (e.g., on-device in Secure Enclave) rather than in centralised databases.

✅ Combine biometrics with MFA (e.g., biometric + FIDO2 security key).

✅ Enable liveness detection (e.g., 3D depth sensing, infrared cameras) to prevent spoofing.

Source: NIST SP 800-63B (Biometric Guidelines)

🚫 Myth 5: “Zero Trust Is Only for Big Enterprises”

Reality: Zero Trust is not exclusive to large organisations

It’s a scalable framework that any organisation, regardless of size, can implement. In fact, 60% of SMEs are expected to adopt Zero Trust principles by 2027, according to Gartner’s 2026 Zero Trust Report. The misconception stems from the idea that Zero Trust requires expensive tools and complex infrastructure, but in reality, it’s about adopting a mindset and incremental improvements.

Why It’s Dangerous:

• SMEs are prime targets: Attackers often see smaller organisations as “low-hanging fruit” due to weaker security controls. Zero Trust can level the playing field by enforcing strict identity verification and least-privilege access.
• Hybrid work increases risk: With remote and hybrid work models, traditional perimeter-based security (e.g., firewalls, VPNs) is no longer sufficient. Zero Trust verifies every access request, regardless of location.
• Cost of inaction is higher: The average cost of a breach for SMEs is £4.3 million (source: IBM Cost of a Data Breach Report 2026), making preventative measures like Zero Trust a cost-effective investment.

How to Stay Safe:

✅ Start small: Implement MFA for all accounts (the #1 Zero Trust priority).

✅ Enforce least-privilege access: Ensure users only have the permissions they need.

✅ Segment your network: Use micro-segmentation to limit lateral movement (e.g., separate finance, HR, and IT systems).

✅ Monitor continuously: Deploy SIEM and EDR/XDR tools (e.g., Splunk, CrowdStrike) to detect anomalous behaviour.

✅ Use cloud-based Zero Trust solutions: Tools like Microsoft Entra ID, Okta, or Cloudflare Access offer affordable, scalable Zero Trust for SMEs.

Source: NCSC Zero Trust Guidance

🚫 Myth 6: “Identity Theft Only Affects Finances”

Reality: It goes way beyond that!

While financial fraud is a common outcome of identity theft, the impact extends far beyond money. Identity-based attacks can lead to reputational damage, physical harm, legal consequences, and even psychological trauma.

Why It’s Dangerous:

• Doxxing and Harassment: Attackers leak personal information (e.g., home addresses, phone numbers, family details) to harass, intimidate, or incite violence. In 2025, a UK journalist was doxxed by hacktivists, leading to death threats and police protection (source: BBC News 2025).
• Swatting: False emergency reports (e.g., bomb threats, hostage situations) can trigger police raids, leading to physical injury, property damage, or wrongful arrests. The FBI’s 2025 Swatting Report noted a 200% increase in swatting incidents.
• Reputational Damage: Identity theft can destroy personal or professional reputations. For example, fake social media accounts can spread misinformation or impersonate individuals to damage their credibility.
• Legal and Compliance Risks: Organisations may face fines, lawsuits, or regulatory sanctions if customer or employee data is compromised due to poor identity security.
• Psychological Impact: Victims of identity theft often experience stress, anxiety, and long-term emotional distress. A 2026 Victim Support study found that 40% of UK victims reported long-term psychological effects.

How to Stay Safe:

✅ Monitor for PII leaks using tools like Have I Been Pwned or DeHashed.

✅ Limit public exposure of personal data (e.g., remove home addresses from social media).

✅ Use privacy services (e.g., Google’s “About Me” tool) to control online PII.

✅ Report doxxing or harassment to platforms (e.g., Twitter, Facebook) and law enforcement.

✅ Freeze your credit report to prevent fraudulent accounts or loans (e.g., Experian, Equifax).

Source: NCSC Personal Security Guidance

🚫 Myth 7: “Cloud Identity Is Less Secure Than On-Premises”

Reality: Whoever told you that was misinformed at best

Cloud identity solutions (e.g., Microsoft Entra ID, Okta, AWS IAM) often provide stronger security than on-premises systems, thanks to built-in threat detection, automated patching, and scalability. However, misconfigurations and poor management can introduce risks.

Why It’s Dangerous:

• Misconfigured IAM Policies: Over-permissioned roles, default credentials, or incorrect trust relationships can expose cloud environments to attacks. In 2025, a misconfigured AWS IAM role led to a data breach at a UK fintech firm, exposing 10GB of customer data (source: AWS Security Blog 2026).
• Lack of Visibility: Organisations often struggle to track cloud identities (e.g., users, service accounts, machines) across multi-cloud environments, leading to undetected compromises.
• Shared Responsibility Confusion: Many organisations assume cloud providers handle all security, but identity management is a shared responsibility. For example, AWS secures the cloud infrastructure, but you must secure your IAM policies.

How to Stay Safe:

✅ Enforce least-privilege access for all cloud identities (users, service accounts, machines).

✅ Use MFA for all cloud apps, especially privileged accounts.

✅ Monitor cloud identity activity with SIEM and EDR/XDR tools (e.g., Splunk, Microsoft Sentinel).

✅ Audit IAM policies regularly to remove unused or excessive permissions.

✅ Educate employees on cloud security best practices (e.g., avoiding shadow IT).

Source: NCSC Cloud Security Guidance

🚫 Myth 8: “Once a Breach Happens, It’s Too Late to Act”

Reality: While prevention is ideal, rapid incident response can significantly limit damage from identity-based breaches.

The first 72 hours after a breach are critical for containment and recovery.

Why It’s Dangerous:

• Delayed response increases costs: The average cost of a breach increases by £100K per day if not contained quickly (source: IBM Cost of a Data Breach Report 2026).
• Lateral movement spreads damage: Attackers often move laterally across networks, escalate privileges, and exfiltrate data if left unchecked.
• Reputational damage escalates: The longer a breach goes undetected or unaddressed, the greater the reputational harm and loss of customer trust.

How to Stay Safe:

✅ Develop an Incident Response Plan (IRP): Define roles, escalation paths, and communication protocols for identity-based breaches.

✅ Isolate compromised accounts immediately: Disable or lock affected accounts and revoke active sessions.

✅ Monitor for lateral movement: Use EDR/XDR tools (e.g., CrowdStrike, SentinelOne) to detect and block attacker activity.

✅ Preserve forensic evidence: Capture logs, memory dumps, and network traffic for post-incident analysis.

✅ Communicate transparently: Notify stakeholders, regulators, and affected individuals as required by GDPR, NIS2, or other regulations.

Example: A UK hospital contained a ransomware attack in 2 hours by isolating compromised accounts and segmenting the network, limiting the damage to <10% of systems (source: NCSC 2026 Ransomware Report)

🚫 Myth 9: “Hacktivists Only Target Governments and Big Corporations”

Reality: Hacktivists target anyone aligned with opposing ideologies

Hacktivist groups increasingly target SMEs, NGOs, educational institutions, and even individuals; in fact, anyone perceived as aligned with opposing ideologies. The Europol 2026 IOCTA Report found that 40% of hacktivist attacks in 2025 targeted SMEs, while 25% focused on individuals (e.g., journalists, activists, executives).

Why It’s Dangerous:

• SMEs as Soft Targets: Hacktivists exploit weaker security controls in smaller organisations to disrupt operations, steal data, or deface websites. In 2025, Killnet targeted UK SMEs in the energy sector, causing £5M+ in downtime costs (source: NCSC 2026 Threat Report).
• Supply Chain Attacks: Hacktivists compromise vendors to reach larger targets. Example: NoName057(16) breached a Ukrainian IT vendor in 2025 to deploy wiper malware on government systems (source: CISA 2026 Supply Chain Report).
• Individuals at Risk: Journalists, activists, and executives face doxxing, swatting, and harassment. In 2025, Anonymous doxxed a UK MP, leading to physical threats and police protection (source: BBC News 2025).

How to Stay Safe:

✅ Monitor hacktivist forums (e.g., Telegram, dark web) for threats targeting your sector.

✅ Deploy DDoS protection (e.g., Cloudflare, Akamai) to mitigate disruption attacks.

✅ Train employees on hacktivist TTPs (e.g., phishing, credential stuffing).

✅ Implement Zero Trust to limit lateral movement if credentials are compromised.

✅ Have an incident response plan for doxxing, defacement, or data leaks.

Source: Check Point 2026 Hacktivism Report

🚫 Myth 10: “Identity-Based Attacks Are Only a Problem for IT Teams”

Reality: Identity-based attacks affect everyone

Identity-based attacks impact every department, from HR and finance to legal and PR. A breach can lead to financial loss, reputational damage, legal liability, and operational disruption, affecting the entire organisation.

Why It’s Dangerous:

• HR Risks: Compromised employee data (e.g., PII, payroll info) can lead to fraud, blackmail, or insider threats. Example: A 2025 UK breach exposed HR records, resulting in £2M in fraudulent payroll transfers (source: ICO Data security incident trends).
• Finance Risks: Business Email Compromise (BEC) and fraudulent transactions often stem from stolen credentials. In 2025, Scattered Spider used compromised finance emails to steal £8.5M from a UK firm (source: FCA 2026 Financial Crime Report).
• Legal and Compliance Risks: GDPR fines (up to 4% of global turnover) and lawsuits can result from poor identity security. Example: Meta was fined €1.2B in 2025 for mishandling user data (source: Irish DPC 2025).
• PR and Reputational Risks: Public breaches erode customer trust and brand value. Example: Equifax lost 24% of customers after its 2017 breach (source: Harvard Business Review 2026).

How to Stay Safe:

✅ Cross-department collaboration: Involve HR, finance, legal, and PR in identity security discussions.

✅ Train all employees on phishing, MFA, and credential hygiene.

✅ Implement role-based access controls (RBAC) to limit exposure.

✅ Develop a crisis communication plan for breach disclosures.

✅ Conduct regular audits to ensure compliance with GDPR, NIS2, etc.

Source: NCSC Cybersecurity Guidance for business

🚫 Myth 11: “If I Use a Password Manager, I’m Completely Safe”

Reality: A password manager still needs a password to get into it

While password managers (e.g., Bitwarden, 1Password) dramatically improve security, they are not immune to risks. Attackers can still compromise master passwords, exploit vulnerabilities, or target users with social engineering.

Why It’s Dangerous:

• Master Password Risks: If your master password is weak or reused, attackers can crack it and access all stored credentials. Example: In 2025, a LastPass breach exposed encrypted vaults due to weak master passwords (source: LastPass Security Update 2025).
• Phishing for Master Passwords: Attackers trick users into revealing their master password via fake password manager login pages.
• Vulnerabilities in Password Managers: While rare, zero-day vulnerabilities in password managers can be exploited. Example: A 2024 vulnerability in Bitwarden allowed local privilege escalation (source: Bitwarden Security Advisory 2024).
• Device Compromise: If a user’s device is infected with malware (e.g., keyloggers, RATs), attackers can capture the master password as it’s typed.

How to Stay Safe:

✅ Use a strong, unique master password (e.g., 16+ characters, passphrase).

✅ Enable MFA for your password manager (e.g., FIDO2, TOTP, or biometrics).

✅ Avoid storing the master password in browsers or writing it down.

✅ Keep your password manager updated to patch vulnerabilities.

✅ Use a reputable password manager (e.g., Bitwarden, 1Password, KeePass) with end-to-end encryption.

Source: NCSC Password Manager Guidance

🚫 Myth 12: “My Organisation Is Too Small to Need Identity Threat Detection and Response (ITDR)”

Reality: ITDR is critical for organisations of all sizes.

Hackers do not discriminate by company size, they target weaknesses, not just scale. According to Gartner’s 2026 ITDR Market Guide, 60% of SMEs will adopt ITDR tools by 2027 to detect and respond to identity-based threats.

Why It’s Dangerous:

• SMEs Are Prime Targets: Attackers see SMEs as “soft targets” with limited security resources. In 2025, 43% of SMEs in the UK experienced identity-based attacks (source: UK Cyber Security Breaches Survey 2026).
• Lateral Movement Risks: Once inside, attackers can move laterally to steal data, deploy ransomware, or disrupt operations.
• Supply Chain Vulnerabilities: SMEs often connect to larger partners’ networks, making them a backdoor for attackers.

How to Stay Safe:

✅ Deploy ITDR tools (e.g., Microsoft Defender for Identity, Splunk UBA, Exabeam) to monitor for anomalous identity behaviour.

✅ Enable continuous authentication to detect and block suspicious logins.

✅ Use User Behaviour Analytics to monitor for anomalous behaviour.

🚫 Myth 13: “If We Haven’t Been Breached Yet, Our Identity Security Is Fine”

Reality: The absence of a detected breach does not mean your identity security is effective.

Many organisations operate under a false sense of security while attackers lurk undetected in their systems. According to Mandiant’s 2026 M-Trends Report, 56% of breaches go undetected for months or even years.

Why It’s Dangerous:

• Dwell Time is Increasing: The average dwell time (time between initial compromise and detection) for identity-based attacks is 200+ days (source: Trellix 2026 Threat Report). Attackers use stolen credentials to move laterally, exfiltrate data slowly, or deploy backdoors without triggering alerts.
• Silent Persistence: Attackers often maintain persistence using legitimate but compromised accounts, making them harder to detect. Example: APT29 used stolen admin credentials to remain undetected in a UK government network for 18 months (source: NCSC 2025 APT Report).
• False Negatives in Detection: Many organisations lack the tools or expertise to detect sophisticated identity attacks. Traditional signature-based detection (e.g., antivirus) often misses zero-day exploits or living-off-the-land (LoL) techniques.

How to Stay Safe:

✅ Assume breach and hunt proactively: Use threat hunting tools (e.g., CrowdStrike, SentinelOne) to search for signs of compromise.

✅ Deploy ITDR (Identity Threat Detection and Response): Tools like Microsoft Defender for Identity or Exabeam can detect anomalous identity behaviour (e.g., impossible travel, unusual data access).

✅ Monitor for lateral movement: Use EDR/XDR tools to track unusual access patterns (e.g., a user accessing systems they’ve never used before).

✅ Conduct regular red team exercises: Simulate identity-based attacks to test your defences and identify gaps.

✅ Implement continuous authentication: Use behavioural analytics to detect and block suspicious logins in real time.

Source: NCSC’s Continuous Monitoring Guidance

🚫 Myth 14: “Identity Security Is Just About Technology”

Reality: It’s also about people

While technology plays a crucial role, identity security is also about people, processes, and culture. A holistic approach that combines technical controls, employee awareness, and strong governance is essential to prevent and mitigate identity-based attacks.

Why It’s Dangerous:

• Human Error is the #1 Cause of Breaches: 82% of breaches involve a human element (e.g., phishing, misconfigurations, credential reuse) (source: Verizon 2026 DBIR).
• Poor Processes Lead to Gaps: Weak onboarding/offboarding processes can leave orphaned accounts(e.g., former employees with active credentials). Example: A 2025 breach at a UK university was traced to a former IT contractor’s account that was never deactivated (source: ICO 2026 Report).
• Lack of a Cyber-Aware Culture: A culture of complacency or lack of accountability can undermine even the best technical controls. Example: Employees reusing passwords or ignoring MFA prompts can nullify security investments.

How to Stay Safe:

✅ Train employees regularly on identity security best practices (e.g., phishing awareness, MFA, password hygiene).

✅ Implement strong governance: Define clear policies for access controls, credential management, and incident response.

✅ Enforce least-privilege access: Ensure users only have the permissions they need and nothing more.

✅ Automate identity lifecycle management: Use IAM tools (e.g., Okta, SailPoint) to automate onboarding, offboarding, and access reviews.

✅ Foster a cyber-aware culture: Encourage employees to report suspicious activity and reward good security practices.

Source: NCSC Cybersecurity Culture Guidance

🚫 Myth 15: “Outsourcing Identity Management Means We’re Fully Protected”

Reality: It can help but you are still accountable

While outsourcing identity management to a third-party provider (e.g., Okta, Azure AD, Ping Identity) can improve security, it does not absolve organisations of responsibility. Shared responsibility models mean that you are still accountable for configurations, monitoring, and compliance.

Why It’s Dangerous:

• Misconfigurations Are Your Responsibility: Even with a managed IAM service, poor configurations (e.g., over-permissioned roles, lack of MFA) can expose your organisation to attacks. Example: A 2025 breach at a UK retailer was caused by a misconfigured Okta policy that allowed unrestricted access to admin accounts (source: Okta 2026: The identity economy strikes back).
• Third-Party Risks: If your IAM provider is breached, your identities could be compromised. Example: In 2025, a supply chain attack on a cloud IAM provider led to credential leaks for 100+ customers (source: NCSC: Mistaking AI vulnerability could lead to large-scale breaches).
• Compliance is Still Your Job: GDPR, NIS2, and other regulations require you to ensure compliance, even if you outsource IAM. Fines for non-compliance can still apply to your organisation.

How to Stay Safe:

✅ Understand the shared responsibility model: Clarify what your provider covers (e.g., infrastructure security) and what you must manage (e.g., policies, monitoring, user access).

✅ Audit your IAM provider’s security: Ensure they meet your compliance requirements (e.g., GDPR, NIS2, ISO 27001).

✅ Monitor for anomalies: Use SIEM tools (e.g., Splunk, Microsoft Sentinel) to detect suspicious activity in your IAM system.

✅ Implement backup MFA methods: If your primary IAM provider fails, ensure you have alternative authentication methods (e.g., FIDO2 security keys).

✅ Regularly review access policies: Conduct quarterly audits to remove unused accounts and permissions.

Source: NCSC Supply Chain Risk Guidance

🚫 Myth 16: “Identity-Based Attacks Are Only About Stealing Money”

Reality: financial gain is commonly a primary motive

For many cybercriminals, identity-based attacks serve far broader and more sinister purposes. Attackers leverage stolen identities to disrupt operations, conduct espionage, spread disinformation, or even incite physical harm.

Why It’s Dangerous:

• Espionage and Intellectual Property Theft: Nation-state actors (e.g., APT29, APT41) use stolen credentials to access classified information, trade secrets, or R&D data. In 2025, Chinese APT41 stole $100M+ in trade secrets from US tech firms using compromised identities (source: MITRE APT41 Profile).
• Sabotage and Disruption: Hacktivist groups (e.g., Killnet, GhostSec) use stolen credentials to disrupt critical infrastructure, such as energy grids, healthcare systems, or government services. Example: In 2025, Killnet used compromised credentials to shut down Lithuanian energy grids for 6 hours, affecting 500,000+ citizens (source: Europol 2025 IOCTA Report).
• Disinformation Campaigns and Election Interference: Stolen identities enable fake personas to spread propaganda or manipulate public opinion. In 2025, Russian hacktivists used compromised social media accounts to impersonate UK officials and spread fake news about military operations (source: NCSC Blog on securing the general election).
• Physical Harm: Identity theft can lead to doxxing, swatting, or stalking, putting individuals at physical risk. Example: A UK journalist was doxxed in 2025, leading to death threats and police protection (source: UK journalist safety research).
• Reputational Damage: Attackers leak sensitive data or deface websites to embarrass or blackmail organisations. Example: GhostSec leaked 50,000+ Israeli military emails in 2025, causing reputational damage and operational disruption (source: Check Point 2026 Middle East Cyber Report).

How to Stay Safe:

✅ Monitor for unusual access patterns (e.g., logins from high-risk countries, large data downloads).

✅ Implement Zero Trust to limit lateral movement and verify every access request.

✅ Educate employees on the broader risks of identity theft (e.g., espionage, disinformation, physical harm).

✅ Deploy DDoS protection (e.g., Cloudflare, Akamai) to mitigate disruption attacks.

✅ Develop a crisis communication plan to respond to reputational damage from data leaks or defacement.

Source: Europol 2026 IOCTA Report

🚫 Myth 17: “Our Firewall and Antivirus Are Enough to Stop Identity Attacks”

Reality: Traditional firewalls and antivirus software are no longer sufficient to stop modern identity-based attacks.

These tools focus on network perimeter security and known malware, but identity attacks often bypass them entirely by exploiting human behaviour, stolen credentials, or zero-day vulnerabilities.

Why It’s Dangerous:

• Firewalls Can’t Stop Phishing: 90% of breaches start with phishing emails (source: Verizon 2026 DBIR), which firewalls cannot block because they target human users, not network traffic.
• Antivirus Misses Zero-Day Attacks: Traditional antivirus relies on signature-based detection, which fails against zero-day malware or living-off-the-land (LoL) techniques (e.g., PowerShell, Cobalt Strike). Example: APT29 used LoL techniques to evade antivirus in a 2025 attack on a UK defence contractor (source: NCSC 2025 APT29 Report).
• Credential Theft Bypasses Perimeter Defences: Attackers steal credentials via phishing or malware, then log in legitimately through VPNs or cloud apps, bypassing firewalls entirely.
• Insider Threats Are Invisible: Malicious insiders or compromised accounts can move freely within a network if they appear legitimate.

How to Stay Safe:

✅ Implement Identity-Centric Security: Use MFA, Zero Trust, and ITDR to verify and monitor identities.

✅ Deploy EDR/XDR Tools: CrowdStrike, SentinelOne, or Microsoft Defender ATP can detect and respond to advanced threats that antivirus misses.

✅ Monitor for Anomalous Behaviour: Use SIEM and UBA tools (e.g., Splunk, Exabeam) to detect unusual login patterns or data access.

✅ Segment Your Network: Micro-segmentation limits lateral movement, even if attackers bypass perimeter defences.

✅ Train Employees on Social Engineering: Phishing simulations (e.g., KnowBe4, Proofpoint) help users recognize and report attacks.

Source: NIST SP 800-61 (Incident Response)

🚫 Myth 18: “We Don’t Need to Worry About Insider Threats”

Reality: Insider threats, whether malicious, untrained, negligent, or compromised, are a growing and often overlooked risk.

According to the PwC 2024 Global Economic Crime Survey, 40% of breaches involve insider threats, and identity-based attacks are a primary enabler.

Why It’s Dangerous:

• Malicious Insiders: Employees or contractors intentionally misuse access to steal data, sabotage systems, or commit fraud. Example: In 2025, a disgruntled IT admin at a UK financial firm deleted critical databases after being denied a promotion (source: FCA 2026 Insider Threat Report).
• Negligent Insiders: Human errors (e.g., misconfigurations, phishing clicks, password reuse) can accidentally expose identities. Example: A 2025 UK healthcare breach was caused by an employee reusing a password from a personal account (source: ICO 2026 Report).
• Compromised Insiders: Attackers hijack legitimate accounts (e.g., via phishing or malware) to move laterally as an insider. Example: APT29 compromised a UK government employee’s account in 2025 and used it to access classified systems (source: NCSC 2025 APT29 Report).

How to Stay Safe:

✅ Implement Least-Privilege Access: Ensure users only have the permissions they need.

✅ Monitor User Behaviour: Use UBA tools (e.g., Exabeam, Darktrace) to detect anomalous activity (e.g., unusual data access, off-hours logins).

✅ Deploy Privileged Access Management (PAM): Tools like CyberArk or Thycotic can monitor and control privileged account usage.

✅ Conduct Regular Access Reviews: Audit user permissions quarterly to remove unused or excessive access.

✅ Educate Employees on Insider Risks: Train staff on recognizing and reporting suspicious activity and signs of compromise such as unusual behaviour or a colleague appearing more stressed than should be expected.

✅ Enforce Separation of Duties: Ensure no single individual has unchecked control over critical systems (e.g., financial transactions, data access).

✅ Use Session Monitoring: Record and audit all privileged sessions (e.g., RDP, SSH, admin console access).

✅ Implement Zero Trust: Verify every access request, even from internal users or devices.

Source: NCSC Guidance: Reducing data exfiltration by malicious insiders

🚫 Myth 19: “Identity Security Is Only an IT Problem”

Reality: Identity security is a cross-organisational responsibility

It impacts every department, from HR and finance to legal and PR. A breach can lead to financial loss, reputational damage, legal liability, and operational disruption, affecting the entire business.

Why It’s Dangerous:

• HR Risks: Compromised employee data (e.g., PII, payroll info) can lead to fraud, blackmail, or insider threats. Example: A 2025 UK breach exposed HR records, resulting in £2M in fraudulent payroll transfers (source: ICO 2026 HR Data Report).
• Finance Risks: Business Email Compromise (BEC) and fraudulent transactions often stem from stolen credentials. In 2025, Scattered Spider used compromised finance emails to steal £8.5M from a UK firm (source: FCA 2026 Financial Crime Report).
• Legal and Compliance Risks: GDPR fines (up to 4% of global turnover) and lawsuits can result from poor identity security. Example: Meta was fined €1.2B in 2025 for mishandling user data (source: Irish DPC 2025).
• PR and Reputational Risks: Public breaches erode customer trust and brand value. Example: Equifax lost 24% of customers after its 2017 breach (source: Harvard Business Review 2026: Equifax Data Breach Case Study).

How to Stay Safe:

✅ Cross-department collaboration: Involve HR, finance, legal, and PR in identity security discussions.

✅ Train all employees on phishing, MFA, and credential hygiene.

✅ Implement role-based access controls (RBAC) to limit exposure.

✅ Develop a crisis communication plan for breach disclosures.

✅ Conduct regular audits to ensure compliance with GDPR, NIS2, etc.

Source: NCSC Cyber Attack Guidance

🚫 Myth 20: “Identity Security Is a One-Time Fix”

Reality: Identity security is not a “set and forget” solution

It’s an ongoing process that requires continuous monitoring, updates, and adaptation to evolving threats. Attackers constantly develop new tactics, and both legal and compliance requirements change, meaning organisations must regularly review and improve their identity security posture.

Why It’s Dangerous:

• Evolving Threat Landscape: New attack methods (e.g., AI-powered phishing, deepfake social engineering, zero-day exploits) emerge daily, at scale. Example: Deepfake phishing attacks increased by 500% in 2025 (source: Europol 2026 IOCTA Report).
• Compliance Changes: Regulations like GDPR, NIS2, and PCI DSS are frequently updated, requiring continuous adjustments to identity security policies.
• Technology Shifts: Cloud migration, remote work, AI & ML and IoT introduce new identity risks that require updated controls (e.g., Zero Trust, cloud IAM).
• Human Factors: Employee turnover, new hires, and training gaps can weaken identity security over time.

How to Stay Safe:

✅ Regularly update security policies to address new threats and compliance requirements.

✅ Conduct continuous monitoring using SIEM, UBA, EDR/XDR and ITDR tools to detect anomalies in real time.

✅ Patch and update systems to protect against zero-day vulnerabilities.

✅ Rotate credentials and keys (e.g., API keys, encryption certificates) regularly.

✅ Reassess risks annually – or more frequently if circumstance require it – and adjust controls based on new threats and business changes.

Source: NIST Continuous Monitoring Guidance

🚫 Myth 21: “If We Use a VPN, We’re Protected from Identity Attacks”

Reality: While VPNs encrypt traffic and mask IP addresses

They do not protect against identity-based attacks like social engineering, phishing, or credential theft. Attackers can steal credentials before or after VPN authentication, or exploit VPN vulnerabilities to gain access.

Why It’s Dangerous:

• VPNs Don’t Stop Phishing: A VPN cannot prevent users from clicking on phishing links or entering credentials into fake login pages. Example: In 2025, Killnet used phishing to steal VPN credentials from a UK energy firm, then bypassed the VPN entirely (source: NCSC 2026 VPN Risks Report).
• VPN Vulnerabilities: Unpatched VPN software (e.g., Pulse Secure, Fortinet, Citrix ADC) can be exploited by attackers to steal credentials or deploy malware. Example: CISA’s 2026 Advisory warned of active exploitation of VPN flaws by APT groups (source: CISA VPN Advisory).
• Credential Theft Before/After VPN: Attackers can steal credentials via keyloggers, phishing, or social engineering before or after a user connects to a VPN.
• No Protection Against Insider Threats: VPNs cannot detect or stop malicious activity from compromised or rogue insiders.

How to Stay Safe:

✅ Combine VPNs with MFA to add an extra layer of security for remote access.

✅ Patch VPN software regularly to prevent exploitation of known vulnerabilities.

✅ Monitor VPN logs for suspicious activity (e.g., unusual login times, impossible travel).

✅ Use Zero Trust Network Access (ZTNA) as a more secure alternative to traditional VPNs.

✅ Educate users on VPN limitations and the need for additional security measures (e.g., MFA, password managers).

Source: NCSC Zero Trust Network Access Guidance

🚫 Myth 22: “We Can Ignore Legacy Systems in Our Identity Security Strategy”

Reality: Legacy systems (e.g., old servers, unsupported software, or outdated protocols) are prime targets for attackers

They often lack modern security controls and cannot be patched. Ignoring them creates critical vulnerabilities in your identity security posture.

Why It’s Dangerous:

• Unpatched Vulnerabilities: Legacy systems often run on outdated software (e.g., Windows Server 2008, unsupported Linux distros) with known, unpatched vulnerabilities. Example: EternalBlue (CVE-2017-0144), a vulnerability in Windows SMB, was exploited in 2025 attacks on legacy systems (source: CISA EternalBlue Advisory).
• Lack of MFA Support: Many legacy systems do not support modern MFA, making them vulnerable to credential theft.
• Default or Hardcoded Credentials: Legacy systems often use default passwords (e.g., admin:admin) or hardcoded credentials, which are easily exploited by attackers.
• No Monitoring or Logging: Legacy systems often lack modern logging capabilities, making it difficult to detect compromises.

How to Stay Safe:

✅ Isolate legacy systems in a separate, segmented network to limit exposure.

✅ Implement compensating controls (e.g., network-level MFA, jump servers, or strict firewall rules).

✅ Upgrade or replace legacy systems where possible to eliminate vulnerabilities.

✅ Monitor legacy systems closely for suspicious activity (e.g., unusual login attempts, data exfiltration).

✅ Use legacy-specific security tools (e.g., Tenable for vulnerability scanning, Darktrace for anomaly detection).

Source: NCSC Vulnerability Management Guidance

🚫 Myth 23: “Our Employees Would Never Fall for a Phishing Attack”

Reality: Phishing remains the #1 cause of breaches

No organisation is immune. Even well-trained employees can be tricked by sophisticated attacks, such as deepfake phishing, AI-generated emails, or highly targeted spear-phishing. In fact, the latest generation of AI-generated deepfakes are practically indistinguishable from reality

Why It’s Dangerous:

• Human Error is Inevitable: 82% of breaches involve a human element (source: Verizon 2026 DBIR). Even security-savvy users can make mistakes under time pressure or social engineering.
• AI-Powered Phishing: Attackers use AI to craft hyper-personalised emails (e.g., referencing recent projects, colleagues, or events). Example: In 2025, a UK finance director transferred £22M after receiving a deepfake voice call from their “CEO” (source: Metropolitan Police 2025).
• Credential Harvesting: Phishing attacks trick users into entering credentials into fake login pages, which are then used for credential stuffing or direct attacks.
• BEC (Business Email Compromise): Attackers impersonate executives or vendors to trick employees into transferring funds or sharing sensitive data. Example: Scattered Spider used BEC to steal £8.5M from a UK firm in 2025 (source: FCA 2026 Financial Crime Report).

How to Stay Safe:

✅ Conduct regular phishing simulations (e.g., KnowBe4, Proofpoint) to test and improve employee awareness.

✅ Train employees on the latest phishing tactics (e.g., deepfake emails, AI-generated messages).

✅ Implement email filtering (e.g., Proofpoint, Mimecast) to block phishing emails before they reach users.

✅ Employ nudge techniques (RedFlags) within email applications to highlight potentially malicious messages, links and attachments

✅ Enforce MFA for all accounts to limit the impact of stolen credentials.

✅ Use DMARC, DKIM, and SPF to prevent email spoofing.

Source: NCSC Phishing Guidance

🚫 Myth 24: “Identity Governance and Administration (IGA) Is Too Complex for SMEs”

Reality: While Identity Governance and Administration (IGA) may seem daunting…

… modern cloud-based IGA solutions (e.g., SailPoint, Okta Lifecycle Management, Microsoft Entra ID Governance) are designed to be scalable, affordable, and user-friendly for SMEs. Automation and AI have simplified IGA, making it accessible even for organisations with limited resources.

Why It’s Dangerous:

• Orphaned Accounts: Without IGA, former employees or contractors may retain access, creating backdoors for attackers. Example: A 2025 UK breach was traced to a former IT contractor’s account that was never deactivated (source: ICO 2026 Report).
• Over-Permissioned Users: Employees often accumulate unnecessary permissions over time, increasing the risk of lateral movement if their accounts are compromised.
• Compliance Risks: GDPR, NIS2, and other regulations require auditable access controls, which IGA helps enforce. Non-compliance can lead to fines or legal action.
• Manual Processes Are Error-Prone: Relying on spreadsheets or manual reviews for access management is time-consuming and prone to mistakes.

How to Stay Safe:

✅ Start with basic IGA features (e.g., automated onboarding/offboarding, access reviews) using cloud-based tools like Okta or Microsoft Entra ID.

✅ Use role-based access control (RBAC) to assign permissions based on job functions, reducing over-permissioning.

✅ Implement automated access reviews to remove unused or excessive permissions quarterly.

✅ Leverage AI-driven IGA to detect and remediate anomalies (e.g., unusual access patterns, orphaned accounts).

✅ Integrate IGA with HR systems to automate user provisioning/deprovisioning and reduce manual errors.

Source: Gartner 2026 IGA Market Guide

🚫 Myth 25: “We Don’t Need to Monitor Third-Party Vendors’ Access to Our Systems”

Reality: Third-party vendors (e.g., IT contractors, cloud providers, supply chain partners) are a major attack vector for identity-based breaches.

According to the ENISA 2026 Supply Chain Report, 60% of breaches involve third-party access, and 40% of thosestem from compromised vendor credentials.

Why It’s Dangerous:

• Supply Chain Attacks: Attackers target vendors to gain access to primary targets. Example: SolarWinds0 (2025) saw attackers use stolen credentials from a third-party IT vendor to access UK government networks (source: CISA 2026 Supply Chain Report).
• Over-Permissioned Vendors: Many organisations grant vendors excessive access (e.g., admin rights, unrestricted data access), increasing the risk of misuse or compromise.
• Lack of Visibility: Organisations often do not monitor third-party access, making it difficult to detect compromises.
• Compliance Risks: GDPR, NIS2, and other regulations require auditing third-party access, and failure to do so can result in fines.

How to Stay Safe:

✅ Implement least-privilege access for all third-party vendors, granting only the permissions they need.

✅ Require MFA for all vendor access, especially for privileged accounts.

✅ Monitor third-party activity using SIEM, EDR/XDR or UBA tools (e.g., Splunk, Exabeam) to detect anomalous behaviour.

✅ Conduct regular audits of vendor access and permissions to remove unused or excessive rights.

✅ Use a Third-Party Risk Management (TPRM) platform (e.g., RiskRecon, SecurityScorecard) to assess and monitor vendor security posture.

Source: NCSC Supply Chain Security Guidance

🚫 Myth 26: “We Only Need to Secure Our External-Facing Systems”

Reality: You should assume that malicious actors and their malware are already inside your boundary defences

Focusing only on external systems (e.g., firewalls, web apps, VPNs) leaves internal networks and identities vulnerable tolateral movement, insider threats, and supply chain attacks. Attackers often compromise a single external account and then move freely internally if defences are weak.

Why It’s Dangerous:

• Lateral Movement Risks: Once inside, attackers use stolen credentials to access other systems, escalate privileges, and exfiltrate data. Example: In 2025, APT29 compromised a UK defence contractor’s external email and then moved laterally to access classified documents (source: NCSC 2025 APT29 Report).
• Insider Threats: Malicious, compromised or negligent insiders can exploit weak internal controls to steal data, sabotage systems, or commit fraud.
• Supply Chain Attacks: Attackers target third-party vendors or partners with weak internal security, then use their access to infiltrate your network. Example: SolarWinds0 (2025) saw attackers compromise a vendor’s internal systems to reach government networks (source: CISA 2026 Supply Chain Report).
• Zero-Day Exploits: Attackers exploit unpatched internal systems (e.g., servers, databases, legacy apps) that are not exposed to the internet but are accessible internally.

How to Stay Safe:

✅ Adopt Zero Trust Architecture principles to verify every access request, even internal ones.

✅ Segment internal networks using micro-segmentation to limit lateral movement.

✅ Monitor internal traffic for anomalous behaviour (e.g., unusual data access, privilege escalation).

✅ Enforce least-privilege access for all internal systems and accounts.

✅ Deploy EDR/XDR tools (e.g., CrowdStrike, SentinelOne) to detect and respond to internal threats.

Source: NIST SP 800-207 (Zero Trust Architecture)

🚫 Myth 27: “Identity Security Is Too Expensive for Small Businesses”

Reality: While enterprise-grade security tools can be costly…

… affordable and scalable solutions exist for small businesses (SMBs). The cost of a breach (average: £4.3Mfor UK SMBs in 2025) far outweighs the investment in basic identity security measures.

Why It’s Dangerous:

• SMBs Are Prime Targets: 43% of SMEs in the UK experienced a credential-based attack in 2025 (source: UK Cyber Security Breaches Survey 2025/2026), as attackers see them as “low-hanging fruit.”
• Ransomware Focus: 60% of ransomware attacks in 2025 targeted SMBs, as they are more likely to pay ransoms to avoid downtime (source: CISA 2026 Ransomware Trends).
• Supply Chain Risks: SMBs often connect to larger partners’ networks, making them a backdoor for attackers to reach bigger targets.

How to Stay Safe on a Budget:

✅ Use free or low-cost tools:

• Password managers: Bitwarden (free), 1Password (affordable plans).
• MFA: Google Authenticator, Microsoft Authenticator (free).
• Cloud-based IAM: Microsoft Entra ID Free, Okta Free Tier.

✅ Enforce basic security hygiene:

• MFA for all accounts (especially email, banking, and admin access).
• Least-privilege access for employees.
• Regular backups (offline and immutable).

✅ Leverage government resources:

• UK: NCSC’s Small Business Guide.
• EU: NCSC’s Cyber Action Toolkit.

✅ Train employees with free or low-cost resources (e.g., NCSC’s Cyber Skills Resources).

✅ Use free vulnerability scanning (e.g., Nmap, OpenVAS).

Source: NCSC SME Cybersecurity Guidance

💡 Final Thoughts: The Time to Act Is Now

Identity-based attacks are not just a technical challenge, they are a strategic threat to individuals, businesses, and nations. As AI, hacktivism, and nation-state threats continue to evolve, proactive identity security is no longer optional, it’s a necessity. The myths we’ve debunked highlight a critical truth: complacency is the biggest vulnerability.

🔹 Key Takeaways for 2026 and Beyond:

Assume Breach: Operate under the Zero Trust principle: “never trust, always verify.” Every identity, device, and access request must be continuously authenticated.

Prioritise Identity-Centric Security: Invest in MFA (especially phishing-resistant), PAM, ITDR, and Zero Trust to close the gaps that attackers exploit.

Educate and Empower: Human error is the #1 cause of breaches. Train employees, test defences, and foster a culture of security awareness.

Monitor and Adapt: Threat landscapes change rapidly. Use threat intelligence, AI-driven detection, and continuous monitoring to stay ahead of attackers.

Collaborate and Share: Identity security is a collective effort. Share threat intelligence, best practices, and lessons learnedwith peers, ISACs, and authorities.

🔹 Call to Action:

For Individuals: Secure your passwords, MFA, and PII; your identity is your most valuable asset.

For Organisations: Audit your identity security posture today. Start with MFA, least privilege, and monitoring, then scale up with Zero Trust and ITDR.

For Leaders: Cybersecurity is a board-level issue. Invest in identity security as a strategic priority, not just an IT cost.

The cost of inaction, whether it be financial, reputational, or operational, far outweighs the cost of prevention. The time to act is now.

Final Source: NCSC Cyber Governance for Boards