Most attackers don't break in any more. They log in. A stolen password, a reused credential or a convincing call to the help desk is often all it takes to get inside, and from there an attacker looks like a legitimate user.
The numbers show how big the problem is. Microsoft's Digital Defense Report 2025 found identity-based attacks rose 32% in the first half of 2025, and more than 97% of them were password attacks such as password spraying and brute force. The same report found multi-factor authentication (MFA), particularly phishing-resistant MFA, blocks more than 99% of identity-based attacks.
In this guide, Avocado identity security specialist Dennis Baltazar covers what identity security includes, how attackers are targeting identities now, what Australian obligations expect, and six practical steps to strengthen your identity and access management (IAM).
What identity security covers
Identity security is the practice of verifying and managing digital identities so only the right people and systems can reach the right resources. It covers authentication (proving who you are), authorisation (what you are allowed to do) and ongoing monitoring to catch misuse.
It spans two kinds of identity.
Human identities are employees, contractors, partners and customers. Strong authentication, least-privilege access and regular access reviews are the foundations here.
Machine identities are used by applications, services, scripts, cloud workloads, IoT devices and robotic process automation to talk to other systems. In most organisations they now outnumber human identities many times over. They rely on API keys, certificates, tokens and service accounts, which are often over-privileged, rarely rotated and owned by nobody in particular.
AI agents are the newest and fastest-growing machine identity. An agent that can read email, query a database or raise a purchase order needs credentials and permissions like any other identity, and the same discipline applies: give it only the access it needs, store its secrets securely, and monitor what it does.
How attackers target identities now
As organisations strengthen password defences, attackers adapt. These are the techniques we see most often.
Password spraying and credential stuffing. Attackers try common or leaked passwords across many accounts at once. Large lists of usernames and passwords from past breaches make this cheap and scalable.
Infostealer malware. Malware on a personal or unmanaged device quietly harvests saved passwords, browser cookies and session tokens, which are then sold or used directly.
Help desk social engineering. An attacker calls the service desk posing as an employee and asks for a password reset or a new MFA device. No technical exploit is needed, just a convincing story.
MFA fatigue and token theft. Attackers bombard users with push notifications until one is approved, or steal session tokens to skip the login altogether.
Abuse of privileged and machine accounts. Once inside, attackers look for admin accounts, service accounts and exposed secrets that let them move further and stay longer.
AI is making all of these faster and more convincing, from realistic phishing emails to cloned voices on help desk calls.
What Australian obligations expect
Identity controls sit at the centre of most Australian security frameworks and regulations.
Essential Eight. The Australian Signals Directorate's Essential Eight includes multi-factor authentication and restricting administrative privileges as two of its eight mitigation strategies. Higher maturity levels require phishing-resistant MFA.
SOCI Act and CIRMP. Critical infrastructure entities must maintain a risk management program that addresses cyber and information security hazards, including who can access critical assets. Read more on our critical infrastructure page.
APRA CPS 234. Banks, insurers and superannuation funds must maintain information security controls proportionate to their threats, and access management is a core part of that.
Regular access reviews, clear ownership of privileged accounts and good audit trails make it much easier to show compliance across all three.
Six steps to strengthen identity security
IAM is a cornerstone of modern security, but it needs regular re-evaluation to keep pace. These six steps run roughly in order of maturity.
- Build an identity inventory. You can't protect what you can't see. Catalogue every identity across the organisation: employees, contractors, partners, customers, service accounts, API keys, certificates and AI agents. Note who owns each one and what it can access.
- Set a strong authentication baseline. Make MFA mandatory for everyone, not just admins, and move towards phishing-resistant methods such as passkeys, FIDO2 security keys and certificate-based authentication. For passwords, require long, unique passphrases, block common and breached passwords, and drop forced periodic changes, which tend to produce weaker passwords.
- Apply least privilege everywhere. Give each identity only the access it needs, and only for as long as it needs it. Review access regularly and remove dormant accounts, which are easy targets for password spraying.
- Get control of privileged access. Privileged access is far more widespread than most organisations realise, from on-premises servers and databases to developer tools and cloud consoles. Vault privileged credentials, use just-in-time access where you can, record privileged sessions, and bring machine and AI agent secrets under the same controls.
- Monitor for identity threats. Use identity threat detection and response to spot unusual behaviour: impossible travel, abnormal privilege use, token replay, or a service account acting out of character. Harden help desk processes so a phone call alone can't reset a password or MFA device.
- Train your people. Make sure staff can recognise phishing, MFA push bombing and social engineering, and know how to report it quickly. Give help desk teams clear verification steps and the backing to use them.
Our modern privileged access management, workforce access governance and identity threat detection and monitoring services cover each of these areas, explore them today.
Where to start
Identity is now the main way attackers get in, which makes it one of the highest-return places to invest in security. Start with an honest view of where you stand.
Our free Cyber Maturity Self-Check gives you an instant maturity score and points to next steps. If you'd like to talk through your identity environment, get in touch.
Explore Avocado’s Identity and Access Management Services.
