--- title: Inside the Modern SOC: The Identity Front Door | daily.dev description: Identity-based attacks now drive nearly 90% of security incidents, with 65% of initial access involving credential theft, MFA manipulation, session hijacking,... canonical: https://daily.dev/posts/inside-the-modern-soc-the-identity-front-door-byluool9n twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Inside the Modern SOC: The Identity Front Door | daily.dev og:description: Identity-based attacks now drive nearly 90% of security incidents, with 65% of initial access involving credential theft, MFA manipulation, session hijacking,... og:url: https://daily.dev/posts/inside-the-modern-soc-the-identity-front-door-byluool9n og:image: https://api.daily.dev/og/posts/bylUoOL9N.png og:image:alt: Inside the Modern SOC: The Identity Front Door og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Inside the Modern SOC: The Identity Front Door **[Unit 42](https://daily.dev/sources/unit42)** · 4 min read · 0 upvotes · 0 comments ## Summary Identity-based attacks now drive nearly 90% of security incidents, with 65% of initial access involving credential theft, MFA manipulation, session hijacking, or social engineering. Threat groups like Muddled Libra (Scattered Spider) exemplify the social-first entry pattern, where attackers blend into legitimate administrative behavior after gaining access. SOC leaders are advised to correlate identity signals with endpoint, cloud, SaaS, and network telemetry; consolidate investigations into a unified view; continuously refine detection rules; and dedicate time to proactive threat hunting. Palo Alto Networks Unit 42 promotes its Cortex SecOps platform and Managed XSIAM service as tools for automating correlation and accelerating response. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What percentage of security incidents involve identity-based attacks? Identity weaknesses played a role in nearly 90% of incidents investigated by Unit 42, per the 2026 Unit 42 Global Incident Response Report. Additionally, 65% of initial access activity involved identity-based techniques such as credential theft, MFA manipulation, session hijacking, and social engineering. 87% of incidents also span multiple attack surfaces once an identity is compromised. _Security teams tracking identity threat trends find the latest incident data on daily.dev before it reaches the broader industry._ ### What are the most common initial access techniques used in identity-driven attacks? The most common initial access techniques in identity-driven attacks are phishing campaigns, social engineering calls, MFA fatigue attacks, compromised third-party accounts, and misuse of help desk processes. Once inside, attackers establish persistence, escalate privileges, and move laterally in ways that closely resemble legitimate administrative behavior, making early detection difficult. _SOC teams refining their detection playbooks for identity attacks keep up with evolving attacker techniques on daily.dev._ ## Similar posts on daily.dev - [Inside the Modern SOC: Defending the Cross-Environment Pivot](https://daily.dev/posts/inside-the-modern-soc-defending-the-cross-environment-pivot-qnbl9zqyj) · Unit 42 · 0 upvotes · 0 comments - [Inside the Modern SOC: The 72-Minute Race](https://daily.dev/posts/inside-the-modern-soc-the-72-minute-race-ueksisyjh) · Unit 42 · 0 upvotes · 0 comments - [Why Your SOC is Blind to Your Biggest Attack Surface \(And How to Fix It\)](https://daily.dev/posts/why-your-soc-is-blind-to-your-biggest-attack-surface-and-how-to-fix-it--ge29stjrb) · Security Boulevard · 0 upvotes · 0 comments - [Fix SOC Blind Spots: See Threats to Your Industry & Country in Real Time](https://daily.dev/posts/fix-soc-blind-spots-see-threats-to-your-industry-country-in-real-time-lgh0ozl7j) · The Hacker News · 0 upvotes · 0 comments - [Identity as the primary attack surface: What modern breaches are really exploiting](https://daily.dev/posts/identity-as-the-primary-attack-surface-what-modern-breaches-are-really-exploiting-6evgscdr6) · CSO Online · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#authentication](https://daily.dev/tags/authentication) [View this post on daily.dev](https://daily.dev/posts/inside-the-modern-soc-the-identity-front-door-byluool9n) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Inside the Modern SOC: The Identity Front Door","url":"https://daily.dev/posts/inside-the-modern-soc-the-identity-front-door-byluool9n","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/inside-the-modern-soc-the-identity-front-door-byluool9n"},"datePublished":"2026-08-07T23:08:49.507Z","dateModified":"2026-08-07T23:09:17.567Z","description":"Identity-based attacks now drive nearly 90% of security incidents, with 65% of initial access involving credential theft, MFA manipulation, session hijacking,...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5f97dbb142a293606aae9d97ce601fb6?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5f97dbb142a293606aae9d97ce601fb6?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Unit 42","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Unit 42","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/5b55ca8d2ae04181939041fbc9d78160","url":"https://daily.dev/sources/unit42"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/inside-the-modern-soc-the-identity-front-door-byluool9n","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,authentication","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Unit 42","item":"https://daily.dev/sources/unit42"},{"@type":"ListItem","position":3,"name":"Inside the Modern SOC: The Identity Front Door"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/inside-the-modern-soc-the-identity-front-door-byluool9n#faq","mainEntity":[{"@type":"Question","name":"What percentage of security incidents involve identity-based attacks?","acceptedAnswer":{"@type":"Answer","text":"Identity weaknesses played a role in nearly 90% of incidents investigated by Unit 42, per the 2026 Unit 42 Global Incident Response Report. Additionally, 65% of initial access activity involved identity-based techniques such as credential theft, MFA manipulation, session hijacking, and social engineering. 87% of incidents also span multiple attack surfaces once an identity is compromised. Security teams tracking identity threat trends find the latest incident data on daily.dev before it reaches the broader industry."}},{"@type":"Question","name":"What are the most common initial access techniques used in identity-driven attacks?","acceptedAnswer":{"@type":"Answer","text":"The most common initial access techniques in identity-driven attacks are phishing campaigns, social engineering calls, MFA fatigue attacks, compromised third-party accounts, and misuse of help desk processes. Once inside, attackers establish persistence, escalate privileges, and move laterally in ways that closely resemble legitimate administrative behavior, making early detection difficult. SOC teams refining their detection playbooks for identity attacks keep up with evolving attacker techniques on daily.dev."}}]} ```