Attackers don't always need to break through an organization's defenses. Increasingly, the systems, identities, applications, and relationships organizations already trust can provide the path in.
That theme runs through several recent cybersecurity developments. A compromise involving a trusted third-party application exposed Microsoft 365 environments to unauthorized access, while Microsoft's latest security research shows how AI is accelerating attack activity without replacing familiar tactics such as credential theft and abuse of legitimate access. At the same time, AI agents are creating yet another class of identity that organizations need to understand and govern.
For organizations managing critical host and mainframe applications, the lesson is especially relevant: identity security needs to follow the user, application, or agent wherever access extends.
When a trusted application becomes the attacker’s identity
An October incident involving ConnectWise Cloud Backup offers a striking example of how application identities can become part of the attack surface.
Researchers reported that a compromised credential belonging to the ConnectWise Cloud Backup application was used to make unauthorized sign-ins across 173 Microsoft 365 partner and customer tenants. The application normally requires broad permissions to perform backup operations across services such as Exchange, OneDrive, SharePoint, Teams, and directory data.
What makes the incident particularly interesting from an identity-security perspective is that the attacker wasn't simply logging in using a stolen employee password. The compromised credential belonged to the application itself, allowing the attacker to obtain tokens using permissions customers had previously granted to that trusted application.
In at least one partner tenant, researchers also observed a related ConnectWise application assign itself Global Administrator privileges and add new credentials to other trusted applications.
Identity governance increasingly has to account for more than employees and administrators.
Applications, service accounts, API credentials, integrations, and other non-human identities can carry substantial privileges. That makes understanding what identities exist, what they can access, and whether those privileges are still appropriate an important part of reducing identity-related risk.
The ConnectWise incident is a particularly useful reminder that "trusted" shouldn't have to mean "trusted indefinitely."
AI is making familiar attacks move faster
AI may be changing cybersecurity, but that doesn't necessarily mean attackers are abandoning the techniques security teams already know.
The Microsoft Digital Defense Report 2026 describes AI as changing the speed and economics of cyberattacks. Microsoft says threat actors are incorporating AI into reconnaissance, social engineering, malware and exploit development, and post-compromise activity. Automation can compress portions of an attack and allow adversaries to operate with greater speed and scale.
But the fundamentals remain familiar.
Microsoft still sees people, identities, exposed systems, and trusted access featuring prominently in threat activity. The report specifically points to unnecessary privileges, persistent access, and weak identity governance as opportunities attackers exploit.
Faster attacks make basic identity-security practices more important, not less.
Microsoft highlights phishing-resistant MFA and passkeys, identity hygiene, tiered administration, and strong privileged-access enforcement among the safeguards organizations should prioritize.
The challenge isn't simply stopping someone from getting through the front door. Security teams also need to understand what a successfully authenticated identity can do once it's inside.
AI agents are identities, too
There's another side to the AI security conversation.
Organizations aren't just defending against attackers who use AI. They're also introducing AI agents into their own environments.
Those agents can interact with enterprise data, applications, APIs, and tools, with differing levels of access and autonomy. Microsoft says those connections are both what make agents useful and part of what security teams need to understand.
Microsoft's 2026 report consequently describes identity as the primary control plane for defense, one that now encompasses human and non-human identities, including applications and agents.
A useful starting point is asking the same questions security teams already ask about other identities:
- What does this identity have access to?
- Does it need that access?
- How is privileged access controlled?
- And can we see when that access is being used?
The technology may be new. The security questions are not.
Don't leave host and mainframe access outside the identity strategy
There is a common thread running through all of these stories: an organization's security boundary increasingly follows identity and access, rather than any single infrastructure platform.
For organizations whose critical applications and data span cloud, distributed, host, and mainframe environments, that makes consistency important.
Modern identity practices shouldn't end when a user reaches a terminal emulator or host application. Strong authentication, appropriate privilege, encryption, access governance, and visibility should be considered across the environments employees use to reach critical enterprise resources.
The goal isn't simply more authentication. It's trusted access that remains trustworthy after authentication.
